c - 如何查看unix/c中某个API正在哪个进程下被调用？ (前提是这个特定的API被许多进程调用)

Question

我的系统上正在运行许多进程。这是一个由每个进程调用的通用 API。所以我想在运行时检查这个特定 API 是从哪个进程调用的，并据此进行一些检查。代码在 c/unix 中

Answer 1

好的，API 是什么意思？这是图书馆吗？是系统调用吗？您需要 strace 或 ltrace 命令。 strace用于系统调用，ltrace用于一般库调用。

假设我想跟踪该程序打开了哪些文件:

#include <stdio.h>

void main() {

    printf(Hello World");
}

我会通过以下方式检查:

$ strace ./a.out 

execve("./a.out", ["./a.out"], [/* 68 vars */]) = 0
brk(0)                                  = 0x2115000
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fea9ff0d000
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=146271, ...}) = 0
mmap(NULL, 146271, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7fea9fee9000
close(3)                                = 0
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
open("/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320\37\2\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=1840928, ...}) = 0
mmap(NULL, 3949248, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7fea9f928000
mprotect(0x7fea9fae3000, 2093056, PROT_NONE) = 0
mmap(0x7fea9fce2000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1ba000) = 0x7fea9fce2000
mmap(0x7fea9fce8000, 17088, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7fea9fce8000
close(3)                                = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fea9fee8000
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fea9fee6000
arch_prctl(ARCH_SET_FS, 0x7fea9fee6740) = 0
mprotect(0x7fea9fce2000, 16384, PROT_READ) = 0
mprotect(0x600000, 4096, PROT_READ)     = 0
mprotect(0x7fea9ff0f000, 4096, PROT_READ) = 0
munmap(0x7fea9fee9000, 146271)          = 0
fstat(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 6), ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fea9ff0c000
write(1, "Hello World", 11Hello World)             = 11
exit_group(11)                          = ?
+++ exited with 11 +++

所以我们看到这个进程调用了两次open函数。您也可以追踪参数。

您还可以将 strace/ltrace 附加到已经运行的进程:

strace -p <PID>

然后您所要做的就是搜索/监视所需的函数调用，并采取相应的行动