Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Reworked trace-loop & adding support for the 27 syscalls from 424 to 450 #26

Merged
merged 5 commits into from
Aug 21, 2023

Conversation

tramasys
Copy link
Contributor

@tramasys tramasys commented Aug 17, 2023

Heya, this PR lays some first groundwork in order to get to tracing parity with strace itself.
I've rewritten the main tracing-loop, to more robustly handle signals and the various other ptrace events (documented in code for now). It's still far from strace's main tracing-loop, but already manages to fix some important bugs.

  • Both exit and exit_group are now properly handled.
  • -f, --follow-forks now actually follows forks.
  • Running a binary that spawns threads won't hang if -f is not supplied.

Some notes of things that aren't yet (properly) implemented:

  1. Signals are passed to the child via ptrace(PTRACE_CONT, ...).
    This needs some work (more complex fall-through logic for WIFSTOPPED(status) and various other edge-cases).

  2. exec-family syscalls can't report their arguments.
    lurk uses exec from std::os::unix::process to load it's tracee into the forked process. This exec from std::os::unix::process issues various other syscalls (like dup2) before actually execve'ing. This makes it quite hard to properly implement logic to catch the arguments of any exec-family syscall. The usual trick to just kill(getpid(), SIGSTOP) after a ptrace(PTRACE_TRACEME, ...) request to give the parent a chance to catch the execve, won't do it in this case.

  3. seccomp

Additionaly I've also added the missing 27 syscalls from number 424 to 450.
Due to the syscall gap from 334 to 424 the solution's probably a bit iffy, but it works. Refactoring definitely welcome. This fixes #24 and probably a bunch of other binaries which rely on these newer syscalls.

@JakWai01
Copy link
Owner

Looks great! Thanks for your contribution 😄

@JakWai01 JakWai01 merged commit ffb8b48 into JakWai01:main Aug 21, 2023
@tramasys tramasys deleted the rework-trace-loop branch August 24, 2023 19:47
@chris-laplante
Copy link

For posterity: Limitations mentioned here are related to #30, #36, #38

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

lurk ls -l hangs
3 participants