Welcome on my blog

Wykonaj komende i śledź jej działanie

strace -t pwd

root@chris:~# strace -t pwd
23:46:19 execve("/bin/pwd", ["pwd"], 0xffa1cf84 /* 18 vars */) = 0
23:46:19 brk(NULL)                      = 0x15dc000
23:46:19 uname({sysname="Linux", nodename="chris", ...}) = 0
23:46:19 access("/etc/ld.so.preload", R_OK) = 0
23:46:19 openat(AT_FDCWD, "/etc/ld.so.preload", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
23:46:19 fstat64(3, {st_mode=S_IFREG|0644, st_size=54, ...}) = 0
23:46:19 mmap2(NULL, 54, PROT_READ|PROT_WRITE, MAP_PRIVATE, 3, 0) = 0xf79a0000
23:46:19 close(3)                       = 0
23:46:19 readlink("/proc/self/exe", "/bin/pwd", 4096) = 8
23:46:19 openat(AT_FDCWD, "/usr/lib/arm-linux-gnueabihf/libarmmem-v8l.so", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
23:46:19 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0\254\3\0\0004\0\0\0"..., 512) = 512
23:46:19 fstat64(3, {st_mode=S_IFREG|0644, st_size=17708, ...}) = 0
23:46:19 mmap2(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xf799e000
23:46:19 mmap2(NULL, 81964, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xf795d000
23:46:19 mprotect(0xf7961000, 61440, PROT_NONE) = 0
23:46:19 mmap2(0xf7970000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x3000) = 0xf7970000
23:46:19 close(3)                       = 0
23:46:19 munmap(0xf79a0000, 54)         = 0
23:46:19 openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
23:46:19 fstat64(3, {st_mode=S_IFREG|0644, st_size=101314, ...}) = 0
23:46:19 mmap2(NULL, 101314, PROT_READ, MAP_PRIVATE, 3, 0) = 0xf7944000
23:46:19 close(3)                       = 0
23:46:19 openat(AT_FDCWD, "/lib/arm-linux-gnueabihf/libc.so.6", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
23:46:19 read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0\274x\1\0004\0\0\0"..., 512) = 512
23:46:19 fstat64(3, {st_mode=S_IFREG|0755, st_size=1291908, ...}) = 0
23:46:19 mmap2(NULL, 1360668, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xf77f7000
23:46:19 mprotect(0xf792f000, 61440, PROT_NONE) = 0
23:46:19 mmap2(0xf793e000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x137000) = 0xf793e000
23:46:19 mmap2(0xf7941000, 8988, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0xf7941000
23:46:19 close(3)                       = 0
23:46:19 set_tls(0xf799ef40)            = 0
23:46:19 mprotect(0xf793e000, 8192, PROT_READ) = 0
23:46:19 mprotect(0xf7970000, 4096, PROT_READ) = 0
23:46:19 mprotect(0x25000, 4096, PROT_READ) = 0
23:46:19 mprotect(0xf79a2000, 4096, PROT_READ) = 0
23:46:19 munmap(0xf7944000, 101314)     = 0
23:46:19 brk(NULL)                      = 0x15dc000
23:46:19 brk(0x15fd000)                 = 0x15fd000
23:46:19 openat(AT_FDCWD, "/usr/lib/locale/locale-archive", O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
23:46:19 fstat64(3, {st_mode=S_IFREG|0644, st_size=3031504, ...}) = 0
23:46:19 mmap2(NULL, 2097152, PROT_READ, MAP_PRIVATE, 3, 0) = 0xf75f7000
23:46:19 mmap2(NULL, 2596864, PROT_READ, MAP_PRIVATE, 3, 0x6b000) = 0xf737d000
23:46:19 close(3)                       = 0
23:46:19 getcwd("/root", 4096)          = 6
23:46:19 fstat64(1, {st_mode=S_IFCHR|0600, st_rdev=makedev(0x88, 0), ...}) = 0
23:46:19 write(1, "/root\n", 6/root
)         = 6
23:46:19 close(1)                       = 0
23:46:19 close(2)                       = 0
23:46:19 exit_group(0)                  = ?
23:46:19 +++ exited with 0 +++

Podłączanie się do istniejącego procesu

strace -p [numer PID procesu]

$ strace -p 18739
pselect6(1, [0], NULL, NULL, {0, 868139653}, {[], 8}) = 0 (Timeout)
openat(AT_FDCWD, "/proc", O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC) = 3
getdents(3, /* 356 entries */, 32768)   = 9072
stat("/proc/1", {st_mode=S_IFDIR|0555, st_size=0, ...}) = 0
open("/proc/1/stat", O_RDONLY)          = 8
read(8, "1 (init) S 0 1 1 0 -1 4219136 62"..., 1024) = 178
close(8)                                = 0
open("/proc/1/statm", O_RDONLY)         = 8
read(8, "8506 1145 675 62 0 480 0n", 1024) = 25
close(8)                                = 0
[...]