Vulnerability Development mailing list archives

Re: Capturing System Calls


From: Darren.Moffat () UK SUN COM (Darren Moffat - Solaris Sustaining Engineering)
Date: Fri, 23 Jun 2000 09:38:56 +0100


You used to be able to do a limited set of this with sotruss...

Yes. apptrace supercedes sotruss.  They are based on the same
mechanism.  sotruss was 'demo-ware' or proof of concept.
apptrace pretty-prints the arguments to the functions.

I don't know where you got the idea that sotruss was demo-ware it is
a fully supported command and it still exists in current versions of
Solaris and as yet no plans have been made to remove it.

apptrace does not replace sotruss it complements it, they also work
a slightly different way.

As of Solaris 7 the functionality of sotruss can be used directly from
truss using the -u flag to select which libraries are traced.

You might also want to look at whocalls(1).

--
Darren J Moffat



Current thread: