/
traceSyscall.go
90 lines (76 loc) · 1.56 KB
/
traceSyscall.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
package main
import (
"bufio"
"fmt"
"os"
"os/exec"
"strings"
"syscall"
)
var maxSyscalls = 0
const SYSCALLFILE = "SYSCALLS"
func main() {
var SYSTEMCALLS []string
f, err := os.Open(SYSCALLFILE)
defer f.Close()
if err != nil {
fmt.Println(err)
return
}
scanner := bufio.NewScanner(f)
for scanner.Scan() {
line := scanner.Text()
line = strings.Replace(line, " ", "", -1)
line = strings.Replace(line, "SYS_", "", -1)
temp := strings.ToLower(strings.Split(line, "=")[0])
SYSTEMCALLS = append(SYSTEMCALLS, temp)
maxSyscalls++
}
COUNTER := make([]int, maxSyscalls)
var regs syscall.PtraceRegs
cmd := exec.Command(os.Args[1], os.Args[2:]...)
cmd.Stdin = os.Stdin
cmd.Stdout = os.Stdout
cmd.Stderr = os.Stderr
cmd.SysProcAttr = &syscall.SysProcAttr{Ptrace: true}
err = cmd.Start()
err = cmd.Wait()
if err != nil {
fmt.Println("Wait:", err)
}
pid := cmd.Process.Pid
fmt.Println("Process ID:", pid)
before := true
forCount := 0
for {
if before {
err := syscall.PtraceGetRegs(pid, ®s)
if err != nil {
break
}
if regs.Orig_rax > uint64(maxSyscalls) {
fmt.Println("Unknown:", regs.Orig_rax)
return
}
COUNTER[regs.Orig_rax]++
forCount++
}
err = syscall.PtraceSyscall(pid, 0)
if err != nil {
fmt.Println("PtraceSyscall:", err)
return
}
_, err = syscall.Wait4(pid, nil, 0, nil)
if err != nil {
fmt.Println("Wait4:", err)
return
}
before = !before
}
for i, x := range COUNTER {
if x != 0 {
fmt.Println(SYSTEMCALLS[i], "->", x)
}
}
fmt.Println("Total System Calls:", forCount)
}