Ecosyste.ms: Awesome
An open API service indexing awesome lists of open source software.
https://github.com/blaind/hstrace
Syscall tracing CLI & library made in Rust
https://github.com/blaind/hstrace
cli command-line command-line-tool rust rust-crate strace syscall syscalls tracing
Last synced: 2 months ago
JSON representation
Syscall tracing CLI & library made in Rust
- Host: GitHub
- URL: https://github.com/blaind/hstrace
- Owner: blaind
- License: other
- Created: 2020-02-16T13:52:37.000Z (almost 5 years ago)
- Default Branch: master
- Last Pushed: 2022-12-12T08:10:36.000Z (about 2 years ago)
- Last Synced: 2024-10-10T16:34:42.357Z (3 months ago)
- Topics: cli, command-line, command-line-tool, rust, rust-crate, strace, syscall, syscalls, tracing
- Language: Rust
- Homepage: https://crates.io/crates/hstrace
- Size: 379 KB
- Stars: 13
- Watchers: 4
- Forks: 2
- Open Issues: 12
-
Metadata Files:
- Readme: README.md
- License: LICENSE-APACHE
Awesome Lists containing this project
README
Syscall tracing CLI & library
==================================================
[](https://github.com/blaind/hstrace/actions?query=branch%3Amaster)
[](https://crates.io/crates/hstrace)
[](https://docs.rs/hstrace)
[](https://github.com/blaind/hstrace)
Syscall tracing from command line and as a library. See the design draft: https://github.com/blaind/hstrace/blob/master/docs/01_hstrace_plan.md
Requires Linux kernel 5.3 or later (uses `PTRACE_GET_SYSCALL_INFO` API)
**This is a WIP implementation, and not production ready. Might not be finished**. Multiple issues exist: 1) codebase is not ready to be expanded yet, major refactoring is needed especially for the `AV` and `Value` structs to be more generic, 2) attach to process is not instant, some calls are missed at beginning, 3) not all syscalls are implemented, 4) cross-platform support is missing, 5) as a comparison, `strace` codebase is over 200k LoC in total (incl comments), so finishing the work is quite an undertaking
## Prequisites
Install dependencies:
```
$ apt-get install libclang1
```
## Command line tool
Install the binary:
```
$ cargo install hstrace
```
Run the command
```
$ hstrace -h
hstrace for stracing processes
USAGE:
hstrace [FLAGS] [OPTIONS] ...
FLAGS:
-h, --help Prints help information
--no-follow Do not follow child processes as they are created
-V, --version Prints version information
OPTIONS:
-e Expression
-m Run mode [default: strace]
-o Save output to a file instead of stderr. If suffix is `.json`, will be stored in JSON-format
(format subject to change)
-p PID to trace
-s Maximum length of printable strings [default: 32]
ARGS:
... Program to strace
```
## Stracing library
### Usage
Add this to your `Cargo.toml`:
```toml
[dependencies]
hstrace = "0.0.4"
```
And this to your code:
```rust
use hstrace::prelude::*;
fn main() {
let mut tracer = HStraceBuilder::new().program("ps").arg("uxaw").build();
tracer.start().unwrap();
for syscall in tracer.iter_as_syscall() {
match syscall.name {
hstrace::Ident::Openat | hstrace::Ident::Fstat | hstrace::Ident::Stat => {
println!("File operation detected: {:?}", syscall);
}
hstrace::Ident::Socket | hstrace::Ident::Bind | hstrace::Ident::Connect => {
println!("Network operation detected: {:?}", syscall);
}
_ => (),
}
}
}
```
See [examples/03_match_syscall_name.rs](examples/03_match_syscall_name.rs) and other [examples](examples).
#### License
Licensed under either of Apache License, Version
2.0 or MIT license at your option.
Unless you explicitly state otherwise, any contribution intentionally submitted
for inclusion in this crate by you, as defined in the Apache-2.0 license, shall
be dual licensed as above, without any additional terms or conditions.