#include #include #include #include #include #include #include #include #ifdef __x86_64__ #define SYSCALL_OFF (ORIG_RAX * 8) #else #define SYSCALL_OFF (ORIG_EAX * 4) #endif int main() { pid_t const child = fork(); if (child == -1) perror("fork failed"); if(child == 0) { ptrace(PTRACE_TRACEME, 0, NULL, NULL); execl("/usr/bin/whoami", "whoami", NULL); perror("execl failed"); } for(;;) { int status; wait(&status); if(WIFEXITED(status)) break; assert(WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP); long const syscall = ptrace(PTRACE_PEEKUSER, child, SYSCALL_OFF, NULL); printf("%ld ", syscall); ptrace(PTRACE_SYSCALL, child, NULL, NULL); } printf("\n"); return 0; }