JakWai01 / lurk

A pretty (simple) alternative to strace
Apache License 2.0
871 stars 28 forks source link

Reworked trace-loop & adding support for the 27 syscalls from 424 to 450 #26

Closed tramasys closed 1 year ago

tramasys commented 1 year ago

Heya, this PR lays some first groundwork in order to get to tracing parity with strace itself. I've rewritten the main tracing-loop, to more robustly handle signals and the various other ptrace events (documented in code for now). It's still far from strace's main tracing-loop, but already manages to fix some important bugs.

Some notes of things that aren't yet (properly) implemented:

  1. Signals are passed to the child via ptrace(PTRACE_CONT, ...). This needs some work (more complex fall-through logic for WIFSTOPPED(status) and various other edge-cases).

  2. exec-family syscalls can't report their arguments. lurk uses exec from std::os::unix::process to load it's tracee into the forked process. This exec from std::os::unix::process issues various other syscalls (like dup2) before actually execve'ing. This makes it quite hard to properly implement logic to catch the arguments of any exec-family syscall. The usual trick to just kill(getpid(), SIGSTOP) after a ptrace(PTRACE_TRACEME, ...) request to give the parent a chance to catch the execve, won't do it in this case.

  3. seccomp

Additionaly I've also added the missing 27 syscalls from number 424 to 450. Due to the syscall gap from 334 to 424 the solution's probably a bit iffy, but it works. Refactoring definitely welcome. This fixes #24 and probably a bunch of other binaries which rely on these newer syscalls.

JakWai01 commented 1 year ago

Looks great! Thanks for your contribution :smile:

chris-laplante commented 4 months ago

For posterity: Limitations mentioned here are related to #30, #36, #38