Retrieving system calls with Ptrace, stopping after first one - c++

Question

I am trying to retrieve all of the numbers of system calls and eventually the names of the system calls called by a give program using ptrace. I am on a 64 bit system so I am using the ORIG_RAX * 8 to find system calls using ptrace. I currently can only retrieve the first system call, output of a sample run is below. Any ideas?
Thanks!
Output:
griffinm#well $ g++ mystrace.cc
~/cs153/assn2
griffinm#well $ a.out ls
Please wait
The child made a system call 59
a.out mystrace.cc mystrace.cc~
Number of machine instructions : 252376
~/cs153/assn2
#include <stdio.h>
#include <stdlib.h>
#include <signal.h>
#include <sys/ptrace.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
#include <errno.h>
#define ORIG_RAX 120
int main( int argc, char* argv[])
{
long long counter = 0; /* machine instruction counter */
int wait_val; /* child's return value */
int pid;
long orig_eax; /* child's process id */
puts("Please wait");
switch (pid = fork()) {
case -1:
perror("fork");
break;
case 0:
ptrace(PTRACE_TRACEME, 0, 0, 0);
execvp(argv[1], NULL);
break;
default:
wait(&wait_val);
orig_eax = ptrace(PTRACE_PEEKUSER,
pid, ORIG_RAX,
NULL);
printf("The child made a "
"system call %ld\n", orig_eax);
while (wait_val == 1407 ) {
counter++;
if (ptrace(PTRACE_SINGLESTEP, pid, 0, 0) != 0)
perror("ptrace");
wait(&wait_val);
}
}
printf("Number of machine instructions : %lld\n", counter);
return 0;
}
Update Default Case:
Default:
wait(&wait_val);
while (wait_val == 1407 ) {
counter++;
if (ptrace(PTRACE_SYSCALL, pid, 0, 0) != 0)
perror("ptrace");
orig_eax = ptrace(PTRACE_PEEKUSER,
pid, 8*ORIG_RAX,
NULL);
cout<<orig_eax<<endl;
wait(&wait_val);
}
}
Edit:
Output:
griffinm#well $ a.out pwd
Please wait
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
-1
/home/csmajs/griffinm/cs153/assn2
-1
-1
-1
-1
-1
-1
I think the 8*Orig_RAX is the problem, the machine is 64 bit like I said. Any ideas?

Answer 1

You probably want to use PTRACE_SYSCALL instead of PTRACE_SINGLESTEP to run the child up to the next system call rather than just a single instruction. Then you can use the PTRACE_PEEKUSER again to see what syscall it is.