システムコールトレーサーの動作原理と実装 (Writing system call tracer for Linux/x86)

システムコールトレーサーの動作原理と実装 (Writing system call tracer for Linux/x86)

• 1.
  AbemaTV Linux / x86Go
• 2.
  AbemaTV Masashi SHIBATA c-bata c_bata_!"
• 3.
  #include <stdio.h> int main(intargc, char *argv[]) { printf("Hello World! %d %sn", argc, argv[0]); return 0; } strace $ gcc hello.c -o hello -Wall -O0 $ strace ./hello hello.c
• 4.
  $ strace ./hello execve("./hello",["./hello"], [/* 25 vars */]) = 0 uname({sys="Linux", node="ip-10-0-2-15.ap- northeast-1.compute.internal", ...}) = 0 : fstat64(1, {st_mode=S_IFCHR|0620, st_rdev=ma… mmap2(NULL, 4096, PROT_READ|PROT_WRITE, … write(1, "Hello World! 1 ./hellon",
 23Hello World! 1 ./hello) = 23 exit_group(0) = ? strace
• 5.
  $ strace ./hello execve("./hello",["./hello"], [/* 25 vars */]) = 0 uname({sys="Linux", node="ip-10-0-2-15.ap- northeast-1.compute.internal", ...}) = 0 : fstat64(1, {st_mode=S_IFCHR|0620, st_rdev=ma… mmap2(NULL, 4096, PROT_READ|PROT_WRITE, … write(1, "Hello World! 1 ./hellon",
 23Hello World! 1 ./hello) = 23 exit_group(0) = ? fork execve
• 6.
  $ strace ./hello execve("./hello",["./hello"], [/* 25 vars */]) = 0 uname({sys="Linux", node="ip-10-0-2-15.ap- northeast-1.compute.internal", ...}) = 0 : fstat64(1, {st_mode=S_IFCHR|0620, st_rdev=ma… mmap2(NULL, 4096, PROT_READ|PROT_WRITE, … write(1, "Hello World! 1 ./hellon",
 23Hello World! 1 ./hello) = 23 exit_group(0) = ? write
• 7.
  Topic 1 Linux /X86 CPU Application Binary Interface System Call Numbers X86 Registers KEYWORDS
• 8.
  ABI: Application BinaryInterface
• 11.
  https://github.com/torvalds/linux/blob/v4.14/arch/x86/entry/syscalls/syscall_32.tbl 0 i386 restart_syscallsys_restart_syscall 1 i386 exit sys_exit 2 i386 fork sys_fork sys_fork 3 i386 read sys_read 4 i386 write sys_write 5 i386 open sys_open compat_sys_open
• 12.
  

• 13.
  Topic 2 ptrace ptrace systemcall https://github.com/c-bata/systrace/ KEYWORDS
• 14.
  ptrace ptrace system call
• 15.
  https://github.com/c-bata/systracer Target(Traced) ProcessTracing Process ptrace(PTRACE_TRACEME,…) waitpid(pid, &status, 0) if WIFEXITED(status) { break; } ptrace(PTRACE_GETREGS, …) ptrace(PTRACE_SYSCALL, …) execve(…) fork() while(1) SIGCONT ! ! ! ! !
• 16.
  https://github.com/c-bata/systrace/