Re: [sct-hackers] Syscalltrack and debugging issues

[Muli Ben-Y. <mu...@mu...>]

On Sat, Jun 19, 2004 at 10:08:15AM +0300, Orna Agmon wrote:

> > I am new to the area, and am looking for a software package
> > the solve a debugging issue that I am not sure is feasible.
> > In short, I would like to be able to intercept a system call
> > and determine which command/funcion call in what C source
> > file within the running application exercised that system
> > call.=20

This can be done if you have debugging information on the
executable. See for example how oprofile goes from EIP to
instruction/function call.=20

> How about hijacking the system call using syscalltrack, and then
> attaching gdb to it?

That will work, if you don't mind doing it manually.=20

> Though I think this should require interfering with the code excuted
> before (or after) the system call - I don't think there is a ready
> mechanism for that, is there?

Actually, there is - you can suspend the process (via action=3DSUSPEND
in the syscalltrack rules file) and then attach to it with a
debugger. Theoretically, it should work :-)=20

Cheers,=20
Muli=20
--=20
Muli Ben-Yehuda
http://www.mulix.org | http://mulix.livejournal.com/