I'm trying to pull out SysCalls from source code but I'm a little confused. I've found source like https://chromium.googlesource.com/chromiumos/docs/+/master/constants/syscalls.md and https://filippo.io/linux-syscall-table/ are syscalls the same as the functions being called in C? or is a syscall something like syscall(SYS_gettid) where the syscall function calls and actual syscall?
I'm trying to extract syscalls that an application uses.
Most of the time, you won’t find explicit syscalls in a program’s source code: applications are written with calls into the corresponding language’s runtime library, and it’s that library which takes care of calling the kernel. Many language runtime libraries delegate that responsibility in turn, relying on the C library.
There isn’t even a one-to-one correspondence between C library functions and syscalls. Some C library functions don’t use any syscalls at all; others use several. The mapping even changes from one architecture to another — Linux has a number of architecture-specific syscalls — and the syscalls which are actually used can very depending on the running kernel and C library, e.g. as the kernel adds new syscalls and support for them is added to the C library.
strace will give you a list of the syscalls made by a program invocation; it won’t give you an exhaustive list of the syscalls in an application.
– Stephen Kitt
Mar 2 at 17:28
Download the source of installwatch, part of the checkinstall package, and modify installwatch.
installwatch uses an LD_PRELOAD trick to intercept ALL system calls. Read man ld.so.
