Re: strace completion (Re: grouping/joining _values)

[Stephane Chazelas <Stephane_Chazelas@xxxxxxxx>]

On Fri, Jun 13, 2008 at 05:04:58PM +0100, Stephane Chazelas wrote:
[...]
> > > > Are there any other useful strategies for extracting the real list of
> > > > syscalls at runtime, so that on systems which package up the same
> > > > version of zsh for N years the list doesn't grow stale?
[...]
> You could get the list from strace itself with:
> 
> ltrace -e strcmp strace -e xxx |& awk -F\" '
>   /xxx/&&/strcmp/{print $4}' | sort -u
[...]

It should be noted that you get a different list (at least here
on a debian system) if you build with -O0 or -O2.

With -O2, you don't get the pseudo ones:

  all
  desc
  file
  network
  none
  process

Same for the signal names for strace -e signal=xxx

Basically, those are cases where the code has

strcmp(var, "blah")
where the compiler is probably unrolling the strcmp as an
optimisation.

as opposed to strcmp(var, othervar).

Of course, you need ltrace installed and strace has to be
dynamically linked.

Another way could be to use a gdb script or a LD_PRELOAD hack.

If strace has been built with debug it's straightforward with
gdb, or with a little more effort with objdump. If not, it's
also possible to use objdump and strings but with some
heuristics to try and find where the table that holds the
syscall name list starts.

-- 
Stéphane