5

How can I set a breakpoint in gdb to stop program at every write to a particular file known by its name?

Alec
  • 8,529
  • 8
  • 37
  • 63
agnonchik
  • 53
  • 3

1 Answers1

7

You can get GDB to stop on every write system call with catch syscall write.

Since write operates on file descriptors, and not on named files, you can't make this breakpoint conditional on the name; you'll have to find out the file descriptor that corresponds to your "interesting" file first.

On Linux, you can look at ls -l /proc/<pid>/fd/* to associate file descriptors with names.

Other systems may have lsof, or other system-specific mechanisms for doing the same.

Once you have the file descriptor, you can make the catch conditional (so GDB stops only when that particular file is written). The exact details of how to do that differ between operating systems and processors, and you didn't supply either.

Employed Russian
  • 199,314
  • 34
  • 295
  • 362
  • catch syscall write works fine: Catchpoint 2 (call to syscall 'write'), 0x0000003137cc6070 in __write_nocancel () from /lib64/libc.so.6 How to get the file descriptor in gdb? – agnonchik Nov 09 '11 at 08:32
  • Which part of "details differ between the OS and the processor, and you didn't say what you are using" didn't you understand? You *probably* are using Linux / x86_64, but you could be using something else, and I'd rather not waste time on a solution that wouldn't work for you. – Employed Russian Nov 09 '11 at 15:04
  • OK, on my 64-bit system, I can use the rdi register that miraculously contains the file descriptor number. Just figured out from [link](http://stackoverflow.com/questions/1538463/how-can-i-put-a-breakpoint-on-something-is-printed-to-the-terminal-in-gdb) – agnonchik Nov 10 '11 at 07:00