I read here this:
Falco depends on a kernel module that taps into the stream of system calls on a machine and passes those system calls to user space.
That hints at the possibility of logging arbitrary instruction invocations from arbitrary processes (but not quite), which is what I would like to know how to do.
I've been recommended ptrace/strace/dtrace/gdb (I have a Mac), but I would like to know what low-level, probably kernel-level feature I could write a kernel module for that would log any process already running in the background on my machine. In the same way that
ps lists the running processes, and
top keeps an updated panel of them with some stats, I would like to basically control a process completely. That is, given
pid 123, I would do
pause 123 or
step 123 to pause or make one step in the program, and then
inspect 123 to look at the complete memory layout of the computer to see what the memory is that has changed. All of this without ptrace/dtrace/strace/gdb.
This is probably a broad topic, but I would like to be pointed to the right area on where to look for more information. Specifically this seems like it could be a kernel module, and so access some features exposed by the kernel API. I'm not sure though if this is technically possible (to watch any process from the outside, at any time, and control its evaluation), or if any part of this is possible. I would first like to know what parts of this are/aren't possible, and then where I can look for more information.
The few tutorials on
gdb I've seen all want you to run/invoke your program/script with
gdb directly, as in
gdb myscript. That makes sense how it could get access to the stepping/pausing/etc. behaviors of the program. But I would like to go further than that. Instead of requiring your program (like gdb) to invoke the program directly, instead it works by attaching to a program already running in the background. And then, just by attaching to the program from the outside, it allows you to pause/step/inspect/etc.. Not sure if this is possible. But this way I could inspect the daemons and other things my computer is doing from the get go.