0

If you execute ./syscallprint ls -l it will print syscall ID's being called by ls -l command.

syscallprint.go

package main

import (
    "fmt"
    "os"
    "os/exec"
    "syscall"
)

func main() {
    var regs syscall.PtraceRegs
    cmd := exec.Command(os.Args[1], os.Args[2:]...)
    cmd.Stderr = os.Stderr
    cmd.Stdin = os.Stdin
    cmd.Stdout = os.Stdout
    cmd.SysProcAttr = &syscall.SysProcAttr{
        Ptrace: true,
    }
    cmd.Start()
    err := cmd.Wait()
    if err != nil {
        fmt.Printf("Wait returned: %v\n", err)
    }
    pid := cmd.Process.Pid
    exit := true
    for {
        if exit {
            err = syscall.PtraceGetRegs(pid, &regs)
            if err != nil {
                break
            }
            fmt.Printf("SystemId: (%x)\n", regs.Orig_rax)
            // TODO: print syscall parameters
        }
        err = syscall.PtraceSyscall(pid, 0)
        if err != nil {
            panic(err)
        }
        _, err = syscall.Wait4(pid, nil, 0, nil)
        if err != nil {
            panic(err)
        }
        exit = !exit
    }
}

Is it possible to get parameters of syscall being made by ls -l?

It seems to be possible with from this question. Is it possible with go-lang?

Yogesh
  • 4,546
  • 2
  • 32
  • 41
  • `syscall.PtraceRegs` is a sturct in Go, not an actual call. What are you trying to do? usually it's used like this `regs := &syscall.PtraceRegs{} err := syscall.PtraceGetRegs(t.Process.Pid, regs)` – vitr May 30 '18 at 00:58
  • that is correct! if you see reference code that is what is done – Yogesh May 30 '18 at 07:12
  • Then what is your question? It's unclear. – thwd May 30 '18 at 15:08
  • sorry, @Yogesh, would you, please, post the actual code instead of this and this? – vitr May 31 '18 at 01:01
  • The answer you linked to uses `regs.rdi ` for the first argument of a syscall. In Go, you'd use `regs.Rdi`, which is a uint64. – Mark Plotnick May 31 '18 at 16:52
  • @MarkPlotnick Yes but how do to get the string value for it! – Yogesh Jun 01 '18 at 07:35
  • @Yogesh I'd try [syscall.PtracePeekData](https://golang.org/pkg/syscall/#PtracePeekData) giving it a byte array sized appropriately, maybe based on one of the system call args or return value (like the third arg to write or the return value from read). – Mark Plotnick Jun 01 '18 at 09:18

0 Answers0