问题
I wrote a program to list all the system calls executed by a command (say /bin/ls). Now what I am trying to do is find all the system call arguments, environment variables, command line arguments that may be passed to it
Example: If I open a file. The system call sys_access will open the file right ? But how to get these values?
Want to do this for system calls like open, read, write, close.
As per my study these must be in the registers (ebx - edx) If so what does these register values signify?
I got this link.
But I really couldn't get much from there. Also any further references for this would be much helpful.
回答1:
(Revised form of comments above (so you can accept it)):
Detailed syscall parameters can be looked up in Linux kernel header syscalls.h. In above case, as sys_access (#33 on x86) has only two parameters:
- first is the pointer to filename, so your file name was stored at address 0x4c4d8e
- Second parameter is file mode (see mode flag defines)
- as there is no third parameter to this syscall, edx is not relevant and contains some undefined value
Return value of this syscall is -2 (ENOENT, defined in errno-base.h), which signifies error (no such file or directory).
Also note (see Basile's comment above) that you are duplicating the functionality of strace utility.
来源：https://stackoverflow.com/questions/9769350/system-call-tracing-using-ptrace