Re: Capturing System Calls

[rdighe () NORTELNETWORKS COM (Rajiv Dighe)]

Is modifying libc a possibility? or that a big no no too? FreeBSD & Linux
*do* come with full libc source. so theoratically you can replace libc with
your version that will contain the hooks that you need. everyone else has
already mentioned about strace/ktrace/truss. so I won't bother.

--Rajiv

----- Original Message -----
From: "Green Charles Contr AFRL/IFGB" <Charles.Green () RL AF MIL>
To: <VULN-DEV () SECURITYFOCUS COM>
Sent: Thursday, June 22, 2000 12:23 PM
Subject: Capturing System Calls

> On UNIX Systems, (FreeBSD, Linux, Solaris) is there a way to
capture/modify
> system calls calls from an application with out modifying the kernel (or
> using kernel modules) - preferably in userspace? The reason I ask is that
a
> group of us are being asked to evaluate a piece of software for my company
> but they've put some heavy restrictions on how we do it. One of the
> restriction is that we're not allowed to modify the kernel.