syscall_tracer.c

#define _GNU_SOURCE
#define _POSIX_C_SOURCE 200809L
#include <stdio.h>
#include <stdlib.h>
#include <sys/ptrace.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <sys/user.h>
#include <syscall.h>
#include <unistd.h>
#include <errno.h>
#include <string.h>

int main(int argc, char **argv)
{
#if !defined(__linux__)
    fprintf(stderr, "syscall_tracer is Linux-only\n");
    return 1;
#else
    if (argc < 2) {
        fprintf(stderr, "usage: %s program [args...]\n", argv[0]);
        return 1;
    }
    pid_t child = fork();
    if (child < 0) {
        perror("fork");
        return 1;
    }
    if (child == 0) {
        if (ptrace(PTRACE_TRACEME, 0, NULL, NULL) < 0) {
            perror("PTRACE_TRACEME");
            _exit(1);
        }
        raise(SIGSTOP);
        execvp(argv[1], &argv[1]);
        perror("execvp");
        _exit(1);
    } else {
        int status;
        if (waitpid(child, &status, 0) < 0) {
            perror("waitpid");
            return 1;
        }
        if (ptrace(PTRACE_SETOPTIONS, child, NULL, PTRACE_O_TRACESYSGOOD) < 0) {
            perror("PTRACE_SETOPTIONS");
            return 1;
        }
        int in_syscall = 0;
        while (1) {
            if (ptrace(PTRACE_SYSCALL, child, NULL, NULL) < 0) {
                perror("PTRACE_SYSCALL");
                break;
            }
            if (waitpid(child, &status, 0) < 0) {
                perror("waitpid");
                break;
            }
            if (WIFEXITED(status) || WIFSIGNALED(status)) {
                break;
            }
            if (!(WIFSTOPPED(status) && (WSTOPSIG(status) & 0x80))) {
                continue;
            }
            struct user_regs_struct regs;
            if (ptrace(PTRACE_GETREGS, child, NULL, &regs) < 0) {
                perror("PTRACE_GETREGS");
                break;
            }
            long sc = regs.orig_rax;
            if (!in_syscall) {
                printf("syscall enter: %ld\n", sc);
                in_syscall = 1;
            } else {
                long ret = regs.rax;
                printf("syscall exit: %ld -> %ld\n", sc, ret);
                in_syscall = 0;
            }
        }
        return 0;
    }
#endif
}