0

Is there a straigtforward way with ready-at-hand tooling to suspend a traced process' execution when a certain syscalls are called with specific parameters? Specifically I want to suspend program execution whenever

stat("/${SOME_PATH}")

or

readlink("/${SOME_PATH}")

are called. I aim to then attach a debugger, so that I can identify which of the hundreds of shared objects that are linked into the process is trying to access that specific path.

strace shows me the syscalls alright, and gdb does the rest. The question is, how to bring them together. This surely can be solved with custom glue-scripting, but I'd rather use a clean solution.

The problem at hand is a 3rd party toolsuite which is available only in binary form and which distribution package completely violates the LSB/FHS and good manners and places shared objects all over the filesystem, some of which are loaded from unconfigurable paths. I'd like to identify which modules of the toolsuite try to do this and either patch the binaries or to file an issue with the vendor.

datenwolf
  • 159,371
  • 13
  • 185
  • 298
  • Is something that is OS-specific OK? Sending a process a SIGSTOP when it makes system calls with certain args is easy with `systemtap` and `dtrace`, but they don't exist everywhere (and require elevated privileges). – Mark Plotnick Apr 11 '18 at 18:42
  • The target OS is Linux, so dtrace is available. @Afshin's answer is suitable, too, however I'd like to see a dtrace solution, too. – datenwolf Apr 11 '18 at 19:45

1 Answers1

1

This is the approach that I use for similar condition in windows debugging. Even though I think it should be possible for you too, I have not tried it with gdb in linux.

  1. When you attached your process, set breakpoint on your system call which is for example stat in your case.
  2. Add a condition based on esp to your breakpoint. For example you want to check stat("/$te"). value at [esp+4] should point to address of string which in this case is "/$te". Then add a condition like: *(uint32_t*)[esp+4] == "/$te". It seems that you can use strcmp() in your condition too as described here.

I think something similar to this should work for you too.

Afshin
  • 8,839
  • 1
  • 18
  • 53