Linux 中的所有系统调用都在哪里恢复？

Question

pstrace可用于跟踪所有SYSCALL，

但是所有SYSCALL都在哪里恢复？

我需要知道这一点，以便我可以使用 grep xxx 来知道 xxx 是否是系统调用。

Answer 1

我认为您参考strace，并且要过滤其输出。

-e strace的选项使您有能力决定应打印哪些呼叫。这是手册中的摘录：

-e trace=file
               Trace  all  system  calls  which  take  a  file  name  as  an  argument.   You  can  think of this as an abbreviation for
               -e trace=open,stat,chmod,unlink,...  which is useful to seeing what files the process is referencing.  Furthermore, using
               the abbreviation will ensure that you don't accidentally forget to include a call like lstat in the list.  Betchya woulda
               forgot that one.

   -e trace=process
               Trace all system calls which involve process management.  This is useful for watching the fork, wait, and exec steps of a
               process.

   -e trace=network
               Trace all the network related system calls.

   -e trace=signal
               Trace all signal related system calls.

   -e trace=ipc
               Trace all IPC related system calls.

   -e trace=desc
               Trace all file descriptor related system calls.

您还可以选择单个系统调用。