Is there any way to get a list of all system calls used in an application without running through all possible scenarios in the app?
3
-
2did you checkout strace command?– alpertSep 29, 2014 at 13:20
-
For sure, that gives only a list of used syscalls during current run. It won't give me all of possibly used syscalls which any part of application code could use. The latter is what I'd want to get.– UVVSep 29, 2014 at 13:26
-
1Short answer: no– wurtelSep 29, 2014 at 13:48
Add a comment
|
1 Answer
In theory, if the application obeys certain constraints, yes. In general, no.
The most common way to invoke system calls is via the standard-library wrappers for the same. So for example, read(fd,buf,BUFLEN) compiles to assembly call read, and in amd64 object code that would be e8 00 00 00 00 (where the zeroes are covered by a symbol-table entry for read). Build a table of all the syscalls used by the standard library, read through the object code looking for calls to the standard library, use that to look up the possible syscalls.
However, a program could also use syscall directly. The first argument is a syscall-number. It could read that number from a file, a command-line argument, standard input, a network socket, or do some lengthy computation (attempt to factor a prime number, sequentially search for input that produces a certain SHA2 hash, run a universal Turing machine until it halts, etc.) to generate it.
A program could also use dlopen/dlsym to call a standard-library function, and it could get the name to call from a file, a command-line argument, standard input, a network socket, or after some lengthy computation. In fact, the standard-library function it might look up could be syscall itself.
So there are programs for which the answer would be, "it might call anything".
