Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have implemented system call hooking for Android 2.6.29 kernel through a LKM module. I am tracing down one Android app for system calls. But interestingly, it returns different results every time I get a list of system calls.

I am not able to make bold text in the code section, so I have put ** to show where the difference starts.

For example,

first run:

our_sys_gettid ---> uid = 10028  
 our_sys_open ---> uid = 10028 with filename= /dev/cpuctl//tasks, flags= 131073, mode=0 
 our_sys_write ---> uid = 10028 with fd= 30, buf = 230 and count=3 
 our_sys_close ---> uid = 10028 with fd= 30  
 our_sys_setpriority ---> uid = 10028 with which= 0, who=230 and niceval=0 
 our_sys_futex ---> uid = 10028 with uadd=������, op=1, val=1, utime=<NULL>, uaddr2=������ and val3=  
 **our_sys_gettid ---> uid = 10028  
 our_sys_open ---> uid = 10028 with filename= /dev/cpuctl//tasks, flags= 131073, mode=0 
 our_sys_clock_gettime ---> uid = 10028 with which_clock=<NULL>, tp =   
 our_sys_clock_gettime ---> uid = 10028 with which_clock=<NULL>, tp =   
 our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=3196467192 
 our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=3196467192 **
 our_sys_clock_gettime ---> uid = 10028 with which_clock=<NULL>, tp =   
 our_sys_clock_gettime ---> uid = 10028 with which_clock=<NULL>, tp =   
 our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=3196466496 
 our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=3196466496 
 our_sys_dup ---> uid = 10028 with fildes=32 
 our_sys_close ---> uid = 10028 with fd= 32  
 .....................

Second run:

our_sys_gettid ---> uid = 10028  
 our_sys_open ---> uid = 10028 with filename= /dev/cpuctl//tasks, flags= 131073, mode=0 
 our_sys_write ---> uid = 10028 with fd= 30, buf = 228 and count=3 
 our_sys_close ---> uid = 10028 with fd= 30  
 our_sys_setpriority ---> uid = 10028 with which= 0, who=228 and niceval=0 
 our_sys_futex ---> uid = 10028 with uadd=������, op=1, val=1, utime=<NULL>, uaddr2=������ and val3=  
 **our_sys_gettid ---> uid = 10028  
 our_sys_open ---> uid = 10028 with filename= /dev/cpuctl//tasks, flags= 131073, mode=0 
 our_sys_write ---> uid = 10028 with fd= 30, buf = 228 and count=3 
 our_sys_clock_gettime ---> uid = 10028 with which_clock=<NULL>, tp =   
 our_sys_clock_gettime ---> uid = 10028 with which_clock=<NULL>, tp =   
 our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=3198662648 
 our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=3198662648 
 our_sys_clock_gettime ---> uid = 10028 with which_clock=<NULL>, tp =   
 our_sys_clock_gettime ---> uid = 10028 with which_clock=<NULL>, tp =   
 our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=3198661952** 
 our_sys_close ---> uid = 10028 with fd= 30  
 our_sys_setpriority ---> uid = 10028 with which= 0, who=228 and niceval=0 
 our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=1181359656 
 our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=3198661952 
 our_sys_dup ---> uid = 10028 with fildes=32 
 our_sys_close ---> uid = 10028 with fd= 32  
 ....................

Third run:

our_sys_gettid ---> uid = 10028  
 our_sys_open ---> uid = 10028 with filename= /dev/cpuctl//tasks, flags= 131073, mode=0 
 our_sys_write ---> uid = 10028 with fd= 31, buf = 228 and count=3 
 our_sys_close ---> uid = 10028 with fd= 31  
 our_sys_setpriority ---> uid = 10028 with which= 0, who=228 and niceval=0 
 our_sys_futex ---> uid = 10028 with uadd=������, op=1, val=1, utime=<NULL>, uaddr2=������ and val3=X{�D  
 **our_sys_clock_gettime ---> uid = 10028 with which_clock=<NULL>, tp =   
 our_sys_clock_gettime ---> uid = 10028 with which_clock=<NULL>, tp =   
 our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=3198035960 
 our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=3198035960 
 our_sys_clock_gettime ---> uid = 10028 with which_clock=<NULL>, tp =   
 our_sys_clock_gettime ---> uid = 10028 with which_clock=<NULL>, tp =   
 our_sys_munmap ---> uid = 10028 with addr=1183178752 and len=770048 
 our_sys_close ---> uid = 10028 with fd= 32**  
 our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=3198035264 
 our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=3198035264 
 our_sys_dup ---> uid = 10028 with fildes=31 
 our_sys_close ---> uid = 10028 with fd= 31  
 ........................

Any idea why it's producing different results every time?

Is there any other better tool to trace system calls? I heard of strace/ptrace, auditd etc but not sure if they are usable for Android or not.

share|improve this question
    
Is the app you're tracing a Java app or a native one? –  Mat Jan 9 '13 at 8:21
    
It's just one simple Android app, coded in Java. –  Junaid Jan 9 '13 at 8:29
2  
Then you can't really expect anything deterministic. You'll see VM background activity (GC in particular but that's not the only thing). Try tracing any Java app on a regular Linux box with strace, it is really chatty. –  Mat Jan 9 '13 at 8:56
    
I used strace binaries on Android emulator but it was giving me list of some system calls (msgget() and msgrecv() ) which are not even implemented by Android as pointed out by Chris at stackoverflow.com/questions/14110856/… –  Junaid Jan 9 '13 at 9:06
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.