Linux中恢复的所有系统调用都在哪里？

Question

pstrace可用于跟踪所有系统调用，

但所有系统调用恢复的位置？

我需要知道这一点，这样我可以用grep xxx知道xxx是否是一个系统调用..

Answer 1

我想你指的strace并要筛选它的输出。

strace的-e选项可让您决定应打印哪些呼叫。以下是手册摘录：

-e trace=file 
       Trace all system calls which take a file name as an argument. You can think of this as an abbreviation for 
       -e trace=open,stat,chmod,unlink,... which is useful to seeing what files the process is referencing. Furthermore, using 
       the abbreviation will ensure that you don't accidentally forget to include a call like lstat in the list. Betchya woulda 
       forgot that one. 

    -e trace=process 
       Trace all system calls which involve process management. This is useful for watching the fork, wait, and exec steps of a 
       process. 

    -e trace=network 
       Trace all the network related system calls. 

    -e trace=signal 
       Trace all signal related system calls. 

    -e trace=ipc 
       Trace all IPC related system calls. 

    -e trace=desc 
       Trace all file descriptor related system calls. 

您也可以选择单个系统调用。