I have tried to hook system calls using linux kernel module. However, when I open a pdf file using Evince, I find no open,read and write is used on this specific file, only lstat is used.

Here is the strace log of strace evince folder1/test.pdf

So I wonder what system call does evince use to open andread from file?

  • 2
    Try strace with the -f (follow) option, since the clone call creates a subprocess. – Thomas Dickey Nov 23 '18 at 1:24
  • @ThomasDickey Thanks, I've updated the log in the link. Now I can see open("/home/xytao/folder1/test.pdf", O_RDONLY) in line 5376, but I still don't see read, maybe because it's using pread? – user6456568 Nov 23 '18 at 1:36
  • perhaps the socket I/O is what's doing it - or pread can. Reading the source-code would help :-) – Thomas Dickey Nov 23 '18 at 1:40
  • Yes, pread. This is the start of the PDF file: pread(19, "%PDF-1.3\r\n%\241\263\305\327\r\n3 0 obj\r\n<</Fil"..., 256, 0) = 256 – filbranden Nov 23 '18 at 2:17

As pointed out by @ThomasDickey, you need to pass strace the -f option, in order to include the trace of all the threads.

(The clone() syscalls are creating new threads, not processes, but you still need -f to have strace follow threads.)

Once you're following all threads, the open becomes aparent, opening the file in read-only mode, on file descriptor 19:

open("/home/xytao/folder1/test.pdf", O_RDONLY) = 19

The contents of the file are read using a succession of pread calls into a small 256 character buffer, the first of which gets the %PDF-1.3 header:

pread(19, "%PDF-1.3\r\n%\241\263\305\327\r\n3 0 obj\r\n<</Fil"..., 256, 0) = 256

If you go through the trace, you'll see it will then lseek to the end of the file (to determine file size), then read a couple of blocks of data from there. I assume that's information about the pages in the document.

The following preads happen at offsets in the middle of the file, but all of them seem to start with some information about "page", so I assume that's evince figuring out about the pages in the PDF document, probably using offsets it got from the end of the file.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.