squeen wrote:
Am I re-inventing your wheel? Have you got this all working already?
hmm... partialy :)
I did get underway with implementing a wrapper for all possible syscalls and outputting useful information to a log. However I did NOT yet look at gmake to see what command it actualy uses. Also I think that's not gonna cover everything, because I also want to catch it if a program adds a line to this and that system config file. read() and write() are very important ones to catch then, because gmake will probably just do system('somecustomshellscriptthatdoesalot.sh') in that case.
The list of syscalls I looked up that need a wrapper is as follows:
Code:
open
old.creat
link
unlink
obs_execv
chdir
mknod
chmod
chown
old.getfsstat
old.lseek
mount
umount
chflags
old.lstat
symlink
readlink
execve
chroot
old.fstat
rename
mkfifo
mkdir
rmdir
stat
lstat
pathconf
truncate
undelete
lchown
lchmod
jail
lchflags
__getcwd
A long list, but some are more important than others. :)
I had done a load of those already (ones with static number of args) but lost that code. However I do know how to do it again. It's not that hard.
The varargs are a BIG problem though. As the very fine FAQ points out:
http://c-faq.com/varargs/handoff.html wrote:
If you do not have the option of rewriting the lower-level function to accept a va_list, such that you find yourself needing to pass the variable arguments that one function (e.g. faterror) receives on to another as actual arguments, no portable solution is possible.
And then the question is.... what to do with the wrappers :)
I wanted it to do all actual writing in a separate diverted location, so packaging it all up is very easy then. But possibly just recording all changes in a log, and then writing a tool that reads the log and generates an idb would be nicer. Loads of options :)