Is there any way to get a list of all system calls used in an application without running through all possible scenarios in the app?

  • 2
    did you checkout strace command?
    – alpert
    Commented Sep 29, 2014 at 13:20
  • For sure, that gives only a list of used syscalls during current run. It won't give me all of possibly used syscalls which any part of application code could use. The latter is what I'd want to get.
    – UVV
    Commented Sep 29, 2014 at 13:26
  • 1
    Short answer: no
    – wurtel
    Commented Sep 29, 2014 at 13:48

1 Answer 1


In theory, if the application obeys certain constraints, yes. In general, no.

The most common way to invoke system calls is via the standard-library wrappers for the same. So for example, read(fd,buf,BUFLEN) compiles to assembly call read, and in amd64 object code that would be e8 00 00 00 00 (where the zeroes are covered by a symbol-table entry for read). Build a table of all the syscalls used by the standard library, read through the object code looking for calls to the standard library, use that to look up the possible syscalls.

However, a program could also use syscall directly. The first argument is a syscall-number. It could read that number from a file, a command-line argument, standard input, a network socket, or do some lengthy computation (attempt to factor a prime number, sequentially search for input that produces a certain SHA2 hash, run a universal Turing machine until it halts, etc.) to generate it.

A program could also use dlopen/dlsym to call a standard-library function, and it could get the name to call from a file, a command-line argument, standard input, a network socket, or after some lengthy computation. In fact, the standard-library function it might look up could be syscall itself.

So there are programs for which the answer would be, "it might call anything".

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .