PATH
on attu
0xb8000
on x86)$ strace -f -- echo hello
output:
execve("./a.out", ["./a.out"], [/* 23 vars */]) = 0
...
write(1, "hello\n", 6) = 6
...
exit_group(0) = ?
execve
(first), write
, exit_group
(last)write
printf
and write
exit_group
$ strace -- uptime
output:
execve("/usr/bin/uptime", ["uptime"], [/* 23 vars */]) = 0
...
open("/proc/uptime", O_RDONLY) = 3
lseek(3, 0, SEEK_SET) = 0
read(3, "1244101.16 14920448.20\n", 2047) = 23
...
exit_group(0) = ?
open
, lseek
, read
, …/proc/uptime
- is this a real file on disk?
(source code)cat /proc/cpuinfo
cat /proc/iomem
$ strace -f -- sh -c uptime
output:
execve("/bin/sh", ["sh", "-c", "uptime"], [/* 23 vars */]) = 0
...
clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7f831c8ac9d0) = 24844
wait4(-1, <unfinished ...>
[pid 24844] execve("/usr/bin/uptime", ["uptime"], [/* 23 vars */]) = 0
[pid 24844] exit_group(0) = ?
[pid 24844] +++ exited with 0 +++
<... wait4 resumed> [{WIFEXITED(s) && WEXITSTATUS(s) == 0}], 0, NULL) = 24844
...
clone
(old days: fork
), wait4
if you don’t see clone
(possibly with old bash), try:
$ strace -f -- sh -c "uptime && true"
draw the system calls for the following (you can use strace
but don’t have to):
$ uptime > file
$ uptime | tr '[a-z]' '[A-Z]'
strace
is implemented