Security/흠..
[AOS] 안드로이드 단말기에서 strace 사용하기
서른마흔다섯개
2023. 5. 10. 00:19
- strace란 ?
시스템 콜 함수들과 시그널 처리에 대해 트레이스 할 수 있는 명령어.
프로세스에서 생성하는 시스템 호출, 그리고 이러한 시스템 호출이 무엇을 반환하는지 확인할 수 있게 해줍니다.
strace 바이너리 다운로드는 아래
다운로드 : https://github.com/andrew-d/static-binaries/tree/master/binaries/linux/arm
GitHub - andrew-d/static-binaries: Various *nix tools built as statically-linked binaries
Various *nix tools built as statically-linked binaries - GitHub - andrew-d/static-binaries: Various *nix tools built as statically-linked binaries
github.com
설치 시작!
1. github에서 다운받은 strace 바이너리를 단말기에 넣어준다!
2. adb로 접속 후 strace 권한을 777로 변경해준다.
3. 명령어 ./strace -p [attach할 pid] -v -s [strsize] -o [file경로] 실행 후 attach한 앱 종료
**앱을 완전히 종료시켜주면 attach가 종료된다.
4. 생성된 결과파일을 오픈해보면
짠!

[☆strace 옵션★]
usage: strace [-CdffhiqrtttTvVxxy] [-I n] [-e expr]...
[-a column] [-o file] [-s strsize] [-P path]...
-p pid... / [-D] [-E var=val]... [-u username] PROG [ARGS]
or: strace -c[df] [-I n] [-e expr]... [-O overhead] [-S sortby]
-p pid... / [-D] [-E var=val]... [-u username] PROG [ARGS]
-c -- count time, calls, and errors for each syscall and report summary
-C -- like -c but also print regular output
-w -- summarise syscall latency (default is system time)
-d -- enable debug output to stderr
-D -- run tracer process as a detached grandchild, not as parent
-f -- follow forks, -ff -- with output into separate files
-i -- print instruction pointer at time of syscall
-q -- suppress messages about attaching, detaching, etc.
-r -- print relative timestamp, -t -- absolute timestamp, -tt -- with usecs
-T -- print time spent in each syscall
-v -- verbose mode: print unabbreviated argv, stat, termios, etc. args
-x -- print non-ascii strings in hex, -xx -- print all strings in hex
-y -- print paths associated with file descriptor arguments
-yy -- print ip:port pairs associated with socket file descriptors
-h -- print help message, -V -- print version
-a column -- alignment COLUMN for printing syscall results (default 40)
-b execve -- detach on this syscall
-e expr -- a qualifying expression: option=[!]all or option=[!]val1[,val2]...
options: trace, abbrev, verbose, raw, signal, read, write
-I interruptible --
1: no signals are blocked
2: fatal signals are blocked while decoding syscall (default)
3: fatal signals are always blocked (default if '-o FILE PROG')
4: fatal signals and SIGTSTP (^Z) are always blocked
(useful to make 'strace -o FILE PROG' not stop on ^Z)
-o file -- send trace output to FILE instead of stderr
-O overhead -- set overhead for tracing syscalls to OVERHEAD usecs
-p pid -- trace process with process id PID, may be repeated
-s strsize -- limit length of print strings to STRSIZE chars (default 32)
-S sortby -- sort syscall counts by: time, calls, name, nothing (default time)
-u username -- run command as username handling setuid and/or setgid
-E var=val -- put var=val in the environment for command
-E var -- remove var from the environment for command
-P path -- trace accesses to path
참고 : https://source.android.com/docs/core/tests/debug/strace?hl=ko
strace 사용 | Android 오픈소스 프로젝트 | Android Open Source Project
strace 사용 컬렉션을 사용해 정리하기 내 환경설정을 기준으로 콘텐츠를 저장하고 분류하세요. strace는 프로세스에서 생성하는 시스템 호출, 그리고 이러한 시스템 호출이 무엇을 반환하는지 확
source.android.com