Linux ltrace跟踪入门

文章目录

- 背景
- ltrace原理
- ltrace使用
- - 跟踪程序调用库函数
  - 跟踪指定pid进程调用
- 参考

本文介绍ltrace跟踪

背景

ltrace 会拦截并记录正在执行的进程所调用的动态库调用以及该进程接收到的信号，它还可以拦截并打印程序执行的系统调用。
其代码位置在：https://gitlab.com/cespedes/ltrace.git

ltrace原理

ltrace也是基于ptrace。

ptrace主要是用来跟踪系统调用，ltrace使用了下面的方法来跟踪库函数：

首先ltrace打开elf文件，对其进行分析。在elf文件中，出于动态连接的需要，需要在elf文件中保存函数的符号，供连接器使用。具体格式，大家可以参考elf文件的格式。这样ltrace就能够获得该文件中，所有系统调用的符号，以及对应的执行指令。
然后，ltrace将该指令所对应的4个字节，替换成断点。其实现可以参考Playing with ptrace, Part II。
这样在进程执行到相应的库函数后，就可以通知到了ltrace，ltrace将对应的库函数打印出来之后，继续执行子进程。

实际上ltrace与strace使用的技术大体相同，但ltrace在对支持fork和clone方面，不如strace。strace在收到frok和clone等系统调用后，做了相应的处理，而ltrace没有。

ltrace使用

$ ltrace --help
Usage: ltrace [option ...] [command [arg ...]]
Trace library calls of a given program.-a, --align=COLUMN  align return values in a secific column.-A MAXELTS          maximum number of array elements to print.-b, --no-signals    don't print signals.-c                  count time and calls, and report a summary on exit.-C, --demangle      decode low-level symbol names into user-level names.-D, --debug=MASK    enable debugging (see -Dh or --debug=help).-Dh, --debug=help   show help on debugging.-e FILTER           modify which library calls to trace.-f                  trace children (fork() and clone()).-F, --config=FILE   load alternate configuration file (may be repeated).-h, --help          display this help and exit.-i                  print instruction pointer at time of library call.-l, --library=LIBRARY_PATTERN only trace symbols implemented by this library.-L                  do NOT display library calls.-n, --indent=NR     indent output by NR spaces for each call level nesting.-o, --output=FILENAME write the trace output to file with given name.-p PID              attach to the process with the process ID pid.-r                  print relative timestamps.-s STRSIZE          specify the maximum string size to print.-S                  trace system calls as well as library calls.-t, -tt, -ttt       print absolute timestamps.-T                  show the time spent inside each call.-u USERNAME         run command with the userid, groupid of username.-V, --version       output version information and exit.-x FILTER           modify which static functions to trace.Report bugs to ltrace-devel@lists.alioth.debian.org

跟踪程序调用库函数

ltrace-demo.c

#include <stdio.h>
#include <unistd.h>
#include <sys/wait.h>
#include "demo-lib.h"void func1()
{printf("func1\n");
}int main()
{printf("ltrace-demo\n");pid_t r = fork();if (r == 0) {printf("in child\n");func2();} else if(r > 0) {printf("child pid: %d\n", r);func1();}wait(NULL);return 0;
}

demo-lib.h

void func2();

demo-lib.c

#include "demo-lib.h"
#include <stdio.h>void func2()
{printf("func2\n");
}

编译测试：

linux-dev@linuxdev:~$ gcc -shared -fPIC -o libdemo-lib.so demo-lib.c
linux-dev@linuxdev:~$ gcc -o ltrace-demo ltrace-demo.c -L. -ldemo-lib
linux-dev@linuxdev:~$ export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:.
linux-dev@linuxdev:~$ ltrace -i ./ltrace-demo 
[0x5c825eca31fe] puts("ltrace-demo"ltrace-demo
)                                                                                   = 12
[0x5c825eca3203] fork()                                                                                                = 1817
[0x5c825eca3246] printf("child pid: %d\n", 1817child pid: 1817
)                                                                       = 16
[0x5c825eca31e0] puts("func1"func1
in child
)                                                                                         = 6
[0x5c825eca325a] wait(0func2<no return ...>
[0x7c30b13107a7] --- SIGCHLD (Child exited) ---
[0x5c825eca325a] <... wait resumed> )                                                                                  = 1817
[0xffffffffffffffff] +++ exited (status 0) +++

跟踪指定pid进程调用

linux-dev@linuxdev:~$ pidof top
1434
linux-dev@linuxdev:~$ sudo ltrace -i -p 1434
[0x618f588eb679] procps_uptime(0x7ffc8ef2b4f0, 0, 0, 0x7d015f325fde)                                                   = 0
[0x618f588eb831] procps_pids_reap(0x618f611f7420, 0, 0, -3616)                                                         = 0x618f611f7458
[0x618f588eb814] memcpy(0x618f61218ea0, "0\020J^\001}\0\08\020J^\001}\0\0@\020J^\001}\0\0H\020J^\001}\0\0"..., 1696)   = 0x618f61218ea0
[0x618f588eb814] memcpy(0x618f612196b0, "0\020J^\001}\0\08\020J^\001}\0\0@\020J^\001}\0\0H\020J^\001}\0\0"..., 1696)   = 0x618f612196b0
[0x618f588eb814] memcpy(0x618f61219ec0, "0\020J^\001}\0\08\020J^\001}\0\0@\020J^\001}\0\0H\020J^\001}\0\0"..., 1696)   = 0x618f61219ec0
[0x618f588eb814] memcpy(0x618f6121a6d0, "0\020J^\001}\0\08\020J^\001}\0\0@\020J^\001}\0\0H\020J^\001}\0\0"..., 1696)   = 0x618f6121a6d0
[0x618f588dc173] procps_stat_reap(0x618f611de980, 0, 0x618f588f7040, 16)                                               = 0x618f611debd0
[0x618f588dc1e3] time(0)                                                                                               = 1739018691
[0x618f588dc20b] procps_meminfo_select(0x618f611f6670, 0x618f588f8180, 9, 3)                                           = 0x618f6121af38
[0x618f588dbb13] putp(0x618f588fb5e0, 0, 0x618f6121af38, 0x2c6b24)                                                     = 0
[0x618f588dbb7e] procps_uptime_sprint(72, 0, 0x2f534, 0)                                                               = 0x7d015f4223a0
[0x618f588dd201] __vsnprintf_chk(0x618f589019c0, 2048, 2, 2048)                                                        = 68
[0x618f588e00bd] strchr("top - 20:44:51 up 30 min,  3 use"..., '\n')                                                   = "\n"
[0x618f588e01f3] __snprintf_chk(0x7ffc8ef2a5e0, 512, 2, 512)                                                           = 87
[0x618f588e0300] __snprintf_chk(0x7ffc8ef2ace0, 2048, 2, 2048)                                                         = 105
[0x618f588e03c5] strcpy(0x7d015eefd010, "\033(B\033[mtop - 20:44:51 up 30 min, "...)                                   = 0x7d015eefd010
[0x618f588e03cd] putp(0x7d015eefd010, 0x7ffc8ef2acff, 1, 9)                                                            = 0
[0x618f588e00bd] strchr("", '\n')                                                                                      = nil
[0x618f588dd201] __vsnprintf_chk(0x618f589019c0, 2048, 2, 2048)                                                        = 91
[0x618f588e00bd] strchr("Tasks:~3 212 ~2total,~3   1 ~2ru"..., '\n')                                                   = "\n"
[0x618f588e01f3] __snprintf_chk(0x7ffc8ef2a5d0, 512, 2, 512)                                                           = 20
[0x618f588e01f3] __snprintf_chk(0x7ffc8ef2a5d0, 512, 2, 512)                                                           = 23
[0x618f588e01f3] __snprintf_chk(0x7ffc8ef2a5d0, 512, 2, 512)                                                           = 20
[0x618f588e01f3] __snprintf_chk(0x7ffc8ef2a5d0, 512, 2, 512)                                                           = 23
[0x618f588e01f3] __snprintf_chk(0x7ffc8ef2a5d0, 512, 2, 512)                                                           = 22