strace.c

#include <errno.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ptrace.h>
#include <sys/user.h>
#include <sys/wait.h>
#include <unistd.h>

void child(char** argv);
void parent(pid_t pid);
void printerror(char* type);
void detach();
char* syscalltostring(long id);

pid_t pid;
char buffer[256];

int main(int argc, char** argv)
{
	if (argc == 1)
	{
		printf("Usage:\n");
		printf("\t%s EXECUTABLE [arg1] ... [argn]\n", argv[0]);
		printf("\t%s -p PID\n", argv[0]);
	}
	else if (strcmp(argv[1], "-p") == 0)
	{
		if (argc != 3 || atoi(argv[2]) <= 0)
		{
			printf("Missing or invalid pid.\n");
		}
		else
		{
			pid = (pid_t)atoi(argv[2]);

			if (ptrace(PTRACE_ATTACH, pid, 0, 0) < 0)
				printerror("PTRACE_ATTACH");

			printf("strace: Process %d attached\n", pid);

			signal(SIGTERM, detach);
			signal(SIGINT, detach);

			parent(pid);
		}
	}
	else
	{
		if ((pid = fork()) < 0)
			printerror("fork()");
		else if (pid == 0)
			child(argv + 1);
		else
			parent(pid);
	}

	return 0;
}

void child(char** argv)
{
	if (ptrace(PTRACE_TRACEME, 0, NULL, NULL) < 0)
		printerror("ptrace()");

	if (execvp(argv[0], argv) < 0)
		printerror("execvp()");
}

void parent(pid_t pid)
{
	printf("Format: syscall_name(rdi, rsi, rdx, r10, r8, r9) = syscall_return_value\n");

	int status, resp = 0;
	struct user_regs_struct regs;

	while (1)
	{
		if (waitpid(pid, &status, 0) == -1)
			printerror("waitpid()");

		if (WIFEXITED(status))
		{
			if (resp == 1)
				printf(" = ?\n");
			else
				printf("%s(%llu, %llu, %llu, %llu, %llu, %llu) = ?\n", syscalltostring(regs.orig_rax), regs.rdi, regs.rsi, regs.rdx, regs.r10, regs.r8, regs.r9);

			printf("--- exited with %llu ---\n", regs.rdi);
			exit(regs.rdi);
		}

		if (ptrace(PTRACE_GETREGS, pid, 0, &regs) == -1)
			printerror("PTRACE_GETREGS");

		if (resp == 0)
			printf("%s(%llu, %llu, %llu, %llu, %llu, %llu)", syscalltostring(regs.orig_rax), regs.rdi, regs.rsi, regs.rdx, regs.r10, regs.r8, regs.r9);

		if ((long)regs.rax == -38)
		{
			resp = 1;
		}
		else
		{
			long code = (long)regs.rax;
			if (code < 0)
				code++;

			printf(" = %ld\n", code);
			resp = 0;
		}

		if (ptrace(PTRACE_SYSCALL, pid, 0, 0) == -1)
			printerror("PTRACE_SYSCALL");
	}
}

void printerror(char* type)
{
	snprintf(buffer, 256, "Error %s", type);
	perror(buffer);
	exit(0);
}

void detach()
{
	if (waitpid(pid, 0, 0) == -1)
		printerror("waitpid()");

	if (ptrace(PTRACE_DETACH, pid, 0, 0) == -1)
		printerror("PTRACE_DETACH");

	printf("\nstrace: Process %d detached\n", pid);
	exit(0);
}

char* syscalltostring(long id)
{
	//Generated from https://filippo.io/linux-syscall-table/
	switch (id)
	{
	case 0:
		return "read";
	case 1:
		return "write";
	case 2:
		return "open";
	case 3:
		return "close";
	case 4:
		return "stat";
	case 5:
		return "fstat";
	case 6:
		return "lstat";
	case 7:
		return "poll";
	case 8:
		return "lseek";
	case 9:
		return "mmap";
	case 10:
		return "mprotect";
	case 11:
		return "munmap";
	case 12:
		return "brk";
	case 13:
		return "rt_sigaction";
	case 14:
		return "rt_sigprocmask";
	case 15:
		return "rt_sigreturn";
	case 16:
		return "ioctl";
	case 17:
		return "pread64";
	case 18:
		return "pwrite64";
	case 19:
		return "readv";
	case 20:
		return "writev";
	case 21:
		return "access";
	case 22:
		return "pipe";
	case 23:
		return "select";
	case 24:
		return "sched_yield";
	case 25:
		return "mremap";
	case 26:
		return "msync";
	case 27:
		return "mincore";
	case 28:
		return "madvise";
	case 29:
		return "shmget";
	case 30:
		return "shmat";
	case 31:
		return "shmctl";
	case 32:
		return "dup";
	case 33:
		return "dup2";
	case 34:
		return "pause";
	case 35:
		return "nanosleep";
	case 36:
		return "getitimer";
	case 37:
		return "alarm";
	case 38:
		return "setitimer";
	case 39:
		return "getpid";
	case 40:
		return "sendfile";
	case 41:
		return "socket";
	case 42:
		return "connect";
	case 43:
		return "accept";
	case 44:
		return "sendto";
	case 45:
		return "recvfrom";
	case 46:
		return "sendmsg";
	case 47:
		return "recvmsg";
	case 48:
		return "shutdown";
	case 49:
		return "bind";
	case 50:
		return "listen";
	case 51:
		return "getsockname";
	case 52:
		return "getpeername";
	case 53:
		return "socketpair";
	case 54:
		return "setsockopt";
	case 55:
		return "getsockopt";
	case 56:
		return "clone";
	case 57:
		return "fork";
	case 58:
		return "vfork";
	case 59:
		return "execve";
	case 60:
		return "exit";
	case 61:
		return "wait4";
	case 62:
		return "kill";
	case 63:
		return "uname";
	case 64:
		return "semget";
	case 65:
		return "semop";
	case 66:
		return "semctl";
	case 67:
		return "shmdt";
	case 68:
		return "msgget";
	case 69:
		return "msgsnd";
	case 70:
		return "msgrcv";
	case 71:
		return "msgctl";
	case 72:
		return "fcntl";
	case 73:
		return "flock";
	case 74:
		return "fsync";
	case 75:
		return "fdatasync";
	case 76:
		return "truncate";
	case 77:
		return "ftruncate";
	case 78:
		return "getdents";
	case 79:
		return "getcwd";
	case 80:
		return "chdir";
	case 81:
		return "fchdir";
	case 82:
		return "rename";
	case 83:
		return "mkdir";
	case 84:
		return "rmdir";
	case 85:
		return "creat";
	case 86:
		return "link";
	case 87:
		return "unlink";
	case 88:
		return "symlink";
	case 89:
		return "readlink";
	case 90:
		return "chmod";
	case 91:
		return "fchmod";
	case 92:
		return "chown";
	case 93:
		return "fchown";
	case 94:
		return "lchown";
	case 95:
		return "umask";
	case 96:
		return "gettimeofday";
	case 97:
		return "getrlimit";
	case 98:
		return "getrusage";
	case 99:
		return "sysinfo";
	case 100:
		return "times";
	case 101:
		return "ptrace";
	case 102:
		return "getuid";
	case 103:
		return "syslog";
	case 104:
		return "getgid";
	case 105:
		return "setuid";
	case 106:
		return "setgid";
	case 107:
		return "geteuid";
	case 108:
		return "getegid";
	case 109:
		return "setpgid";
	case 110:
		return "getppid";
	case 111:
		return "getpgrp";
	case 112:
		return "setsid";
	case 113:
		return "setreuid";
	case 114:
		return "setregid";
	case 115:
		return "getgroups";
	case 116:
		return "setgroups";
	case 117:
		return "setresuid";
	case 118:
		return "getresuid";
	case 119:
		return "setresgid";
	case 120:
		return "getresgid";
	case 121:
		return "getpgid";
	case 122:
		return "setfsuid";
	case 123:
		return "setfsgid";
	case 124:
		return "getsid";
	case 125:
		return "capget";
	case 126:
		return "capset";
	case 127:
		return "rt_sigpending";
	case 128:
		return "rt_sigtimedwait";
	case 129:
		return "rt_sigqueueinfo";
	case 130:
		return "rt_sigsuspend";
	case 131:
		return "sigaltstack";
	case 132:
		return "utime";
	case 133:
		return "mknod";
	case 134:
		return "uselib";
	case 135:
		return "personality";
	case 136:
		return "ustat";
	case 137:
		return "statfs";
	case 138:
		return "fstatfs";
	case 139:
		return "sysfs";
	case 140:
		return "getpriority";
	case 141:
		return "setpriority";
	case 142:
		return "sched_setparam";
	case 143:
		return "sched_getparam";
	case 144:
		return "sched_setscheduler";
	case 145:
		return "sched_getscheduler";
	case 146:
		return "sched_get_priority_max";
	case 147:
		return "sched_get_priority_min";
	case 148:
		return "sched_rr_get_interval";
	case 149:
		return "mlock";
	case 150:
		return "munlock";
	case 151:
		return "mlockall";
	case 152:
		return "munlockall";
	case 153:
		return "vhangup";
	case 154:
		return "modify_ldt";
	case 155:
		return "pivot_root";
	case 156:
		return "_sysctl";
	case 157:
		return "prctl";
	case 158:
		return "arch_prctl";
	case 159:
		return "adjtimex";
	case 160:
		return "setrlimit";
	case 161:
		return "chroot";
	case 162:
		return "sync";
	case 163:
		return "acct";
	case 164:
		return "settimeofday";
	case 165:
		return "mount";
	case 166:
		return "umount2";
	case 167:
		return "swapon";
	case 168:
		return "swapoff";
	case 169:
		return "reboot";
	case 170:
		return "sethostname";
	case 171:
		return "setdomainname";
	case 172:
		return "iopl";
	case 173:
		return "ioperm";
	case 174:
		return "create_module";
	case 175:
		return "init_module";
	case 176:
		return "delete_module";
	case 177:
		return "get_kernel_syms";
	case 178:
		return "query_module";
	case 179:
		return "quotactl";
	case 180:
		return "nfsservctl";
	case 181:
		return "getpmsg";
	case 182:
		return "putpmsg";
	case 183:
		return "afs_syscall";
	case 184:
		return "tuxcall";
	case 185:
		return "security";
	case 186:
		return "gettid";
	case 187:
		return "readahead";
	case 188:
		return "setxattr";
	case 189:
		return "lsetxattr";
	case 190:
		return "fsetxattr";
	case 191:
		return "getxattr";
	case 192:
		return "lgetxattr";
	case 193:
		return "fgetxattr";
	case 194:
		return "listxattr";
	case 195:
		return "llistxattr";
	case 196:
		return "flistxattr";
	case 197:
		return "removexattr";
	case 198:
		return "lremovexattr";
	case 199:
		return "fremovexattr";
	case 200:
		return "tkill";
	case 201:
		return "time";
	case 202:
		return "futex";
	case 203:
		return "sched_setaffinity";
	case 204:
		return "sched_getaffinity";
	case 205:
		return "set_thread_area";
	case 206:
		return "io_setup";
	case 207:
		return "io_destroy";
	case 208:
		return "io_getevents";
	case 209:
		return "io_submit";
	case 210:
		return "io_cancel";
	case 211:
		return "get_thread_area";
	case 212:
		return "lookup_dcookie";
	case 213:
		return "epoll_create";
	case 214:
		return "epoll_ctl_old";
	case 215:
		return "epoll_wait_old";
	case 216:
		return "remap_file_pages";
	case 217:
		return "getdents64";
	case 218:
		return "set_tid_address";
	case 219:
		return "restart_syscall";
	case 220:
		return "semtimedop";
	case 221:
		return "fadvise64";
	case 222:
		return "timer_create";
	case 223:
		return "timer_settime";
	case 224:
		return "timer_gettime";
	case 225:
		return "timer_getoverrun";
	case 226:
		return "timer_delete";
	case 227:
		return "clock_settime";
	case 228:
		return "clock_gettime";
	case 229:
		return "clock_getres";
	case 230:
		return "clock_nanosleep";
	case 231:
		return "exit_group";
	case 232:
		return "epoll_wait";
	case 233:
		return "epoll_ctl";
	case 234:
		return "tgkill";
	case 235:
		return "utimes";
	case 236:
		return "vserver";
	case 237:
		return "mbind";
	case 238:
		return "set_mempolicy";
	case 239:
		return "get_mempolicy";
	case 240:
		return "mq_open";
	case 241:
		return "mq_unlink";
	case 242:
		return "mq_timedsend";
	case 243:
		return "mq_timedreceive";
	case 244:
		return "mq_notify";
	case 245:
		return "mq_getsetattr";
	case 246:
		return "kexec_load";
	case 247:
		return "waitid";
	case 248:
		return "add_key";
	case 249:
		return "request_key";
	case 250:
		return "keyctl";
	case 251:
		return "ioprio_set";
	case 252:
		return "ioprio_get";
	case 253:
		return "inotify_init";
	case 254:
		return "inotify_add_watch";
	case 255:
		return "inotify_rm_watch";
	case 256:
		return "migrate_pages";
	case 257:
		return "openat";
	case 258:
		return "mkdirat";
	case 259:
		return "mknodat";
	case 260:
		return "fchownat";
	case 261:
		return "futimesat";
	case 262:
		return "newfstatat";
	case 263:
		return "unlinkat";
	case 264:
		return "renameat";
	case 265:
		return "linkat";
	case 266:
		return "symlinkat";
	case 267:
		return "readlinkat";
	case 268:
		return "fchmodat";
	case 269:
		return "faccessat";
	case 270:
		return "pselect6";
	case 271:
		return "ppoll";
	case 272:
		return "unshare";
	case 273:
		return "set_robust_list";
	case 274:
		return "get_robust_list";
	case 275:
		return "splice";
	case 276:
		return "tee";
	case 277:
		return "sync_file_range";
	case 278:
		return "vmsplice";
	case 279:
		return "move_pages";
	case 280:
		return "utimensat";
	case 281:
		return "epoll_pwait";
	case 282:
		return "signalfd";
	case 283:
		return "timerfd_create";
	case 284:
		return "eventfd";
	case 285:
		return "fallocate";
	case 286:
		return "timerfd_settime";
	case 287:
		return "timerfd_gettime";
	case 288:
		return "accept4";
	case 289:
		return "signalfd4";
	case 290:
		return "eventfd2";
	case 291:
		return "epoll_create1";
	case 292:
		return "dup3";
	case 293:
		return "pipe2";
	case 294:
		return "inotify_init1";
	case 295:
		return "preadv";
	case 296:
		return "pwritev";
	case 297:
		return "rt_tgsigqueueinfo";
	case 298:
		return "perf_event_open";
	case 299:
		return "recvmmsg";
	case 300:
		return "fanotify_init";
	case 301:
		return "fanotify_mark";
	case 302:
		return "prlimit64";
	case 303:
		return "name_to_handle_at";
	case 304:
		return "open_by_handle_at";
	case 305:
		return "clock_adjtime";
	case 306:
		return "syncfs";
	case 307:
		return "sendmmsg";
	case 308:
		return "setns";
	case 309:
		return "getcpu";
	case 310:
		return "process_vm_readv";
	case 311:
		return "process_vm_writev";
	case 312:
		return "kcmp";
	case 313:
		return "finit_module";
	default:
		sprintf(buffer, "%ld", id);
		return buffer;
	}
}