Trace of Process

프로세스의 Trace를 위한 추적 Utility

* ltrace(Library trace)

- strace보다 한단계 추상 수준을 높인 도구로 library call을 보여줌
- Dynamic libary link에 대해서만 추적이 가능

-> object file 내부에서 이뤄지는 자체적인 호출은 추적 불가능

[root@localhost Example]# vi hello.c

  1 #include <stdio.h>
  2 #include <stdlib.h>
  3
  4 main()
  5 {
  6     FILE* fp;
  7
  8     printf("Hello World!\n");
  9
 10     fp =fopen("hello.c", "rw");
 11
 12     fclose(fp);
 13     exit(0);
 14 }

[root@localhost Example]# ltrace ./hello

__libc_start_main(0x8048464, 1, 0xbfb07104, 0x80484c0, 0x80484b0 <unfinished ...>
puts("Hello World!"Hello World!)                                              = 13
fopen("hello.c", "rw")                                                             = 0x812b008
fclose(0x812b008)                                                                  = 0
exit(0 <unfinished ...>
+++ exited (status 0) +++

---

[root@localhost Example]# vi hello1.c

  1 #include <stdio.h>
  2
  3 main()
  4 {
  5     printf("Hello World!\n");
  6
  7 }

[root@localhost Example]# ltrace ./hello1
__libc_start_main(0x80483b4, 1, 0xbfdb8bb4, 0x80483e0, 0x80483d0 <unfinished ...>
puts("Hello World!"Hello World!)                                          = 13
+++ exited (status 13) +++

*strace(System Call trace)

- 프로그램이 커널과 상호작용하는 모든 system call 내역을 보여줌
- 프로그램 규모가 커지면 strace 결과가 많아지므로 filtering해서 해석하는 방법 숙지

- system call을 많이 사용하지 않고 알고리즘 위주로 작성한 프로그램의 경우에는 strace로 추적해도 소용없음
- system call interface를 이용해 system call을 추적
- kernel에서 제공하는 system call은 개념상으로 일반적인 function call과 유사하지만 system call를 한 시점에서

kernel mode로 전환해서 실제 system call routine을 실행한다는 중요한 차이점

[root@localhost Example]# vi hello.c

  1 #include <stdio.h>
  2 #include <stdlib.h>
  3
  4 main()
  5 {
  6     FILE* fp;
  7
  8     printf("Hello World!\n");
  9
 10     fp =fopen("hello.c", "rw");
 11
 12     fclose(fp);
 13     exit(0);
 14 }

[root@localhost Example]# gcc -o hello hello.c
[root@localhost Example]# strace ./hello

 <결과 화면>

execve("./hello", ["./hello"], [/* 34 vars */]) = 0
brk(0)                                  = 0x811e000
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY)      = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=137077, ...}) = 0
mmap2(NULL, 137077, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb8073000
close(3)                                = 0
open("/lib/libc.so.6", O_RDONLY)        = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\300\2531\0004\0\0\0\304"..., 512) = 512
fstat64(3, {st_mode=S_IFREG|0755, st_size=1803388, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb8072000
mmap2(0x304000, 1513768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x304000
mprotect(0x46f000, 4096, PROT_NONE)     = 0
mmap2(0x470000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x16b) = 0x470000
mmap2(0x473000, 10536, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x473000
close(3)                                = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb8071000
set_thread_area({entry_number:-1 -> 6, base_addr:0xb80716c0, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useable:1}) = 0
mprotect(0x470000, 8192, PROT_READ)     = 0
mprotect(0x300000, 4096, PROT_READ)     = 0
munmap(0xb8073000, 137077)              = 0
fstat64(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 4), ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb8094000
write(1, "Hello World!\n"..., 13Hello World!)       = 13
brk(0)                                  = 0x811e000
brk(0x813f000)                          = 0x813f000
open("hello.c", O_RDONLY)               = 3
close(3)                                = 0
exit_group(0)                           = ?

---

[root@localhost Example]# vi hello1.c

  1 #include <stdio.h>
  2
  3 main()
  4 {
  5     printf("Hello World!\n");
  6
  7 }

[root@localhost Example]# gcc -o hello1 hello1.c
[root@localhost Example]# strace ./hello1

 <결과 화면>

execve("./hello1", ["./hello1"], [/* 34 vars */]) = 0
brk(0)                                  = 0x98cc000
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY)      = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=137077, ...}) = 0
mmap2(NULL, 137077, PROT_READ, MAP_PRIVATE, 3, 0) = 0xb7f0e000
close(3)                                = 0
open("/lib/libc.so.6", O_RDONLY)        = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\300\2531\0004\0\0\0\304"..., 512) = 512
fstat64(3, {st_mode=S_IFREG|0755, st_size=1803388, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f0d000
mmap2(0x304000, 1513768, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x304000
mprotect(0x46f000, 4096, PROT_NONE)     = 0
mmap2(0x470000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x16b) = 0x470000
mmap2(0x473000, 10536, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x473000
close(3)                                = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f0c000
set_thread_area({entry_number:-1 -> 6, base_addr:0xb7f0c6c0, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useable:1}) = 0
mprotect(0x470000, 8192, PROT_READ)     = 0
mprotect(0x300000, 4096, PROT_READ)     = 0
munmap(0xb7f0e000, 137077)              = 0
fstat64(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 4), ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f2f000
write(1, "Hello World!\n"..., 13Hello World!)       = 13
exit_group(13)                          = ?