0

I read here this:

Falco depends on a kernel module that taps into the stream of system calls on a machine and passes those system calls to user space.

(Emphasis mine).

That hints at the possibility of logging arbitrary instruction invocations from arbitrary processes (but not quite), which is what I would like to know how to do.

I've been recommended ptrace/strace/dtrace/gdb (I have a Mac), but I would like to know what low-level, probably kernel-level feature I could write a kernel module for that would log any process already running in the background on my machine. In the same way that ps lists the running processes, and top keeps an updated panel of them with some stats, I would like to basically control a process completely. That is, given pid 123, I would do pause 123 or step 123 to pause or make one step in the program, and then inspect 123 to look at the complete memory layout of the computer to see what the memory is that has changed. All of this without ptrace/dtrace/strace/gdb.

This is probably a broad topic, but I would like to be pointed to the right area on where to look for more information. Specifically this seems like it could be a kernel module, and so access some features exposed by the kernel API. I'm not sure though if this is technically possible (to watch any process from the outside, at any time, and control its evaluation), or if any part of this is possible. I would first like to know what parts of this are/aren't possible, and then where I can look for more information.

The few tutorials on gdb I've seen all want you to run/invoke your program/script with gdb directly, as in gdb myscript. That makes sense how it could get access to the stepping/pausing/etc. behaviors of the program. But I would like to go further than that. Instead of requiring your program (like gdb) to invoke the program directly, instead it works by attaching to a program already running in the background. And then, just by attaching to the program from the outside, it allows you to pause/step/inspect/etc.. Not sure if this is possible. But this way I could inspect the daemons and other things my computer is doing from the get go.

1

gdb can do exactly what you describe. You can attach to running process 123 using a command such as:

$ gdb -p 123

Or passing the path to the executable:

$ gdb /path/to/program 123

You can use the attach command from gdb prompt to the same effect.

That seems to do everything you describe, since gdb is already able to pause, step and inspect memory of an attached process (and do even more, like modify contents of memory.)

The underlying kernel feature used by gdb is ptrace(2) (beware, there be dragons!), so if you want something similar to gdb but different in some way, you can look into using ptrace for that purpose.

Developing a new kernel interface could of course be done, but it's unclear what that would offer that ptrace still doesn't... The hooks needed for this kind of feature are probably quite invasive into the kernel, so you would need a heavily patched kernel source tree to create something akin to ptrace (not likely done in a simple loadable kernel module.)

In short, gdb and ptrace do what you describe. You can of course develop alternatives to this tool and syscall, just unclear what the point of that would be.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.