I'm trying to pull out SysCalls from source code but I'm a little confused. I've found source like https://chromium.googlesource.com/chromiumos/docs/+/master/constants/syscalls.md and https://filippo.io/linux-syscall-table/ are syscalls the same as the functions being called in C? or is a syscall something like syscall(SYS_gettid) where the syscall function calls and actual syscall?

I'm trying to extract syscalls that an application uses.


Most of the time, you won’t find explicit syscalls in a program’s source code: applications are written with calls into the corresponding language’s runtime library, and it’s that library which takes care of calling the kernel. Many language runtime libraries delegate that responsibility in turn, relying on the C library.

There isn’t even a one-to-one correspondence between C library functions and syscalls. Some C library functions don’t use any syscalls at all; others use several. The mapping even changes from one architecture to another — Linux has a number of architecture-specific syscalls — and the syscalls which are actually used can very depending on the running kernel and C library, e.g. as the kernel adds new syscalls and support for them is added to the C library.

  • Thanks for the answer. Learned a lot on that one. Would strace be one practical way to get a list of syscalls in an application? – Jason Mar 2 at 17:26
  • 2
    strace will give you a list of the syscalls made by a program invocation; it won’t give you an exhaustive list of the syscalls in an application. – Stephen Kitt Mar 2 at 17:28

Download the source of installwatch, part of the checkinstall package, and modify installwatch.

installwatch uses an LD_PRELOAD trick to intercept ALL system calls. Read man ld.so.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.