0

I am trying to create a monitoring application for Android as part of a project. For this, I want to use strace, but I was unable to make Strace work on a Real Device.

To test Strace, initially I tried to start Strace using Adb with the following code:

adb shell
root@mako:/ # strace -p 9807

Strace starts correctly but (as far as I can see) whenever any user input comes to the application, it gives the following output and while Strace exits, The application it traces restarts itself:

clock_gettime(CLOCK_MONOTONIC, {68514, 862578038}) = 0

clock_gettime(CLOCK_MONOTONIC, {68514, 862822201}) = 0

clock_gettime(CLOCK_MONOTONIC, {68514, 863035844}) = 0

clock_gettime(CLOCK_MONOTONIC, {68514, 863249487}) = 0

clock_gettime(CLOCK_MONOTONIC, {68514, 863463129}) = 0

--- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0xd} ---

sigaction(SIGSEGV, {SIG_DFL, [], SA_RESTART}, {0xb520a3b9, [], SA_STACK|SA_SIGINFO}, 0) = 0

sigaction(SIGHUP, {0xb520a3b9, [], SA_STACK|SA_SIGINFO}, NULL, 0) = 0

prctl(PR_GET_NAME, 0xb6fcbb6c, 0, 0, 0) = 0

socket(PF_LOCAL, SOCK_DGRAM|SOCK_CLOEXEC, 0) = 31

fcntl64(31, F_SETFL, O_RDONLY|O_NONBLOCK) = 0

connect(31, {sa_family=AF_LOCAL, sun_path="/dev/socket/logdw"}, 110) = 0

clock_gettime(CLOCK_REALTIME, {1420310998, 749300862}) = 0

writev(1, [{"\4", 1}, {"\365%", 2}, {"\3269\250T~l\251,", 8}, {"\7", 1}, {"libc\0", 5}, {"Fatal signal 1 (???), code 1 in "..., 59}], 6) = 76

close(1) = 0

prctl(PR_GET_DUMPABLE) = 1

socket(PF_LOCAL, SOCK_STREAM, 0) = 1

connect(1, {sa_family=AF_LOCAL, sun_path=@"android:debuggerd"}, 20) = 0

write(1, "\0\0\0\0\365%\0\0\0\0\0\0\1\0\0\0", 16) = 16

read(1, "", 1) = 0

close(1) = 0

sigaction(SIGHUP, {SIG_DFL, [], SA_RESTART}, {0xb520a3b9, [], SA_STACK|SA_SIGINFO}, 0) = 0

rt_sigreturn() = 1545157337

--- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0xd} ---

+++ killed by SIGSEGV +++

When I try the same thing on a emulator, it works fine.

My device is rooted and I believe I gave necessary permissions to adb (SuperSU asked to grant SuperUser rights and the shell is root@mako). I also downloaded an strace binary, pushed it to device and tried to trace it by opening in an app (by trying to trace the same app Strace is opened), but it also gives a similar behaviour.

I tried this both with both Usb Debugging enabled and Eclipse open and without Usb debugging. When Eclipse is open, before the app crashes Logcat gives the following log:

01-03 21:15:13.936: E/(11338): ptrace attach failed: Operation not permitted

which makes me think that it is a permission issue, but it is also confusing since strace works until a user input is given.

So right now I am very confused about why Strace does not work on my device. Any help or pointers to the right direction is appreciated.

Edit: I am using Android 5.0.1 which may or may not also be an issue here, because I read somewhere that there are some problems with ptrace after Kitkat due to security improvements, but again I am not sure if this is the problem. Any confirmation/ solution would be perfect.

Community
  • 1
  • 1
merterpam
  • 765
  • 6
  • 14
  • Likely your strace is subtly incompatible with your device or subtly broken. Making one work in a multithreaded environment is especially tricky. Can you use the ndk gdb/gdbserver instead? What are you actually trying to accomplish? – Chris Stratton Jan 03 '15 at 20:08
  • I can understand that the binary strace I pushed to device is incompatible or broken, but adb's Strace also behaves the same way which I doubt is broken. Maybe when I rooted, something may have gone wrong at my device (Although it was a very clean progres..) I am trying to create an application which monitors system calls made by other applications to detect suspicious behaviour for a term project. I was thinking strace was a perfect tool for that. I will take a look at gbdserver, thanks! – merterpam Jan 03 '15 at 20:24
  • adb does not have a systrace, it is merely an interface. I don't know if stock Android ships one at your version, but even if "official" as infrequently used code it could be stale/unworkable. Understanding the ptrace refusal could be key: someone else already doing that? Wrong user? Selinux? Wrong call? – Chris Stratton Jan 03 '15 at 20:34

1 Answers1

0

I got the same error with my nexus4 running cm-12.1.

adb shell
root@mako:/ # strace -p pid
...
something
...
+++ killed by SIGSEGV +++

mostly,when I try to use the app being straced. The error shows up.

Then I tried another rom, and strace works. :)

Likely your strace is subtly incompatible with your device or subtly broken as Chris Stratton said.

madgd
  • 16
  • 2