Linux中恢復的所有系統調用都在哪裏？

Question

pstrace可用於跟蹤所有系統調用，

但所有系統調用恢復的位置？

我需要知道這一點，這樣我可以用grep xxx知道xxx是否是一個系統調用..

Answer 1

我想你指的strace並要篩選它的輸出。

strace的-e選項可讓您決定應打印哪些呼叫。以下是手冊摘錄：

-e trace=file 
       Trace all system calls which take a file name as an argument. You can think of this as an abbreviation for 
       -e trace=open,stat,chmod,unlink,... which is useful to seeing what files the process is referencing. Furthermore, using 
       the abbreviation will ensure that you don't accidentally forget to include a call like lstat in the list. Betchya woulda 
       forgot that one. 

    -e trace=process 
       Trace all system calls which involve process management. This is useful for watching the fork, wait, and exec steps of a 
       process. 

    -e trace=network 
       Trace all the network related system calls. 

    -e trace=signal 
       Trace all signal related system calls. 

    -e trace=ipc 
       Trace all IPC related system calls. 

    -e trace=desc 
       Trace all file descriptor related system calls. 

您也可以選擇單個系統調用。