python-ptrace can trace system calls (using PTRACE_SYSCALL).
PtraceSyscall
ptrace.syscall module contains PtraceSyscall class: it's a parser of Linux syscalls similar to strace program. Examples:
connect(5, <sockaddr_in sin_family=AF_INET, sin_port=53, sin_addr=212.27.54.252>, 28) = 0
open('/usr/lib/i686/cmov/libcrypto.so.0.9.8', 0, 0 <read only>) = 4
mmap2(0xb7e87000, 81920, 3, 2066, 4, 297) = 0xb7e87000
rt_sigaction(SIGWINCH, 0xbfb7d4a8, 0xbfb7d41c, 8) = 0
You can get more informations: result type, value address, argument types, and argument names. Examples:
long open(const char* filename='/usr/lib/i686/cmov/libcrypto.so.0.9.8' at 0xb7efc027, int flags=0, int mode=0 <read only>) = 4 long fstat64(unsigned long fd=4, struct stat* buf=0xbfa46e2c) = 0 long set_robust_list(struct robust_list_head* head=0xb7be5710, size_t len_ptr=12) = 0
strace.py
Program strace.py is very close to strace program: display syscalls of a program. Example:
Features
- Nice output of signal: see python-ptrace signal handling
- Supports multiple processes
- Can trace running process
- Can display arguments name, type and address
- Option --filename to show only syscall using file names
- Option --socketcall to show only syscall related to network (socket usage)
- Option --syscalls to list all known syscalls
Example
$ ./strace.py /bin/ls
execve(/bin/ls, ['/bin/ls'], [/* 40 vars */]) = 756
brk(0) = 0x0805c000
access('/etc/ld.so.nohwcap', 0) = -2 (No such file or directory)
mmap2(NULL, 8192, 3, 34, -1, 0) = 0xb7f56000
access('/etc/ld.so.preload', 4) = -2 (No such file or directory)
(...)
close(1) = 0
munmap(0xb7c5c000, 4096) = 0
exit_group(0)
---done---
Options
The program has many options. Example with --socketcall (display only network functions):
$ ./strace.py --socketcall nc localhost 8080 execve(/bin/nc, ['/bin/nc', 'localhost', '8080'], [/* 40 vars */]) = 12948 socket(AF_FILE, SOCK_STREAM, 0) = 3 connect(3, <sockaddr_un sun_family=AF_FILE, sun_path=/var/run/nscd/socket>, 110) = -2 (No such file or directory) socket(AF_FILE, SOCK_STREAM, 0) = 3 connect(3, <sockaddr_un sun_family=AF_FILE, sun_path=/var/run/nscd/socket>, 110) = -2 (No such file or directory) socket(AF_INET, SOCK_STREAM, 6) = 3 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, 3217455272L, 4) = 0 connect(3, <sockaddr_in sin_family=AF_INET, sin_port=8080, sin_addr=127.0.0.1>, 16) = -111 (Connection refused) (...)
