Recoding Strace, why I can't catch the "write syscall ?"

Question

I am currently recode the Strace command.

I understand the goal of this command and I can catch some syscalls from an exectuable file.

My question is : Why I don't catch the "write" syscall ?

this is my code :

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/ptrace.h>
#include <sys/user.h>
#include <wait.h>

int main(int argc, char* argv[]) {
   int status;
   pid_t pid;
   struct user_regs_struct regs;
   int counter = 0;
   int in_call =0;

   switch(pid = fork()) {
      case -1:
         perror("fork");
         exit(1);
      case 0:
         ptrace(PTRACE_TRACEME, 0, NULL, NULL);
         execvp(argv[1], argv + 1);
         break;
      default:
         wait(&status);
         while (status == 1407) {
             ptrace(PTRACE_GETREGS, pid, NULL, &regs);
             if(!in_call) {
                  printf("SystemCall %lld called with %lld, %lld,     %lld\n",regs.orig_rax, 
                       regs.rbx, regs.rcx, regs.rdx);
                  in_call=1;
                  counter ++;
             }
             else
                in_call = 0;
             ptrace(PTRACE_SYSEMU, pid, NULL, NULL);
             wait(&status);
        }
   }
   printf("Total Number of System Calls = %d\n", counter);
   return 0;
}

This is the output using my program :

./strace ./my_program

SystemCall 59 called with 0, 0,     0
SystemCall 60 called with 0, 4198437,     5
Total Number of System Calls = 2

59 represents the execve syscall. 60 represents the exit syscall. This is the output using the real strace :

strace ./my_program

execve("./my_program", ["./bin_asm_write"], 0x7ffd2929ae70 /* 67 vars */) = 0
write(1, "Toto\n", 5Toto
)           = 5
exit(0)                                 = ?
+++ exited with 0 +++

As you can see, my program don't catch the write syscall.

I don't understrand why, do you have any idea ?

Thank You for your answer.

Answer 1

Your while loop is set up rather strangely -- you have this in_call flag that you toggle back and forth between 0 and 1, and you only print the system call when it is 0. The net result is that while you catch every system call, you only print every other system call. So when you catch the write call, the flag is 1 and you don't print anything.

Another oddness is that you're using PTRACE_SYSEMU rather than PTRACE_SYSCALL. SYSEMU is intended for emulating system calls, so the system call won't actually run at all (it will be skipped); normally your ptracing program would do whatever the systme call is supposed to do itself and then call PTRACE_SETREGS to set the tracee's registers with the appropriate return values before calling PTRACE_SYSEMU again to run to the next system call.

Your in_call flagging would make more sense if you were actually using PTRACE_SYSCALL, as that will stop twice for each syscall -- once on entry to the syscall and a second time when the call returns. However, it will also stop for signals, so you need to be decoding the status to see if a signal has occurred or not.