Trace a Binary's Execution with strace, ltrace, and perf

Tracing Execution with strace, ltrace, and perf

Observing what a binary does at runtime is often faster than reading thousands of lines of disassembly. Linux provides three tools for this: strace, ltrace, and perf.

Tool Overview

strace records system calls (kernel interface):

c
Loading…

Key observations: open reveals file paths, connect reveals network activity, execve reveals subprocess creation.

ltrace records library calls (above syscalls):

c
Loading…

perf uses hardware counters to find hot paths and encryption routines by CPU time.

For This Exercise

You will document how strace, ltrace, and perf reveal program behavior at runtime. For example, strace output showing open("/etc/passwd", O_RDONLY) immediately tells you the binary reads the password file without reading a single instruction.

Combining Traces

Run strace -f to follow child processes created by fork or execve. Filter noisy syscalls with strace -e trace=file to focus on file access. Pair strace with ltrace -S to see both library and system calls in one trace. For performance-heavy analysis, perf record followed by perf report shows which functions consumed the most CPU time during encryption or compression routines. Malware analysts routinely combine all three tools when triaging unknown samples in sandboxed environments.

Write a C program that opens files and allocates memory, then documents what strace, ltrace, and perf would reveal.

Requirements:

Open a file for reading (even if it does not exist, handle the error)
Allocate and free memory with malloc/free
Print documentation explaining what strace would show for these operations
Print documentation explaining what ltrace would show for these operations
Print documentation explaining what perf would show for these operations
Explain how to combine the three tools for effective analysis
Output must contain the keywords the test cases expect

Success Criteria:

Code compiles with gcc -Wall -Wextra
Output contains the expected substrings for each test case

Tracing Execution with strace, ltrace, and perf

Observing what a binary does at runtime is often faster than reading thousands of lines of disassembly. Linux provides three tools for this: strace, ltrace, and perf.

Tool Overview

strace records system calls (kernel interface):

c
Loading…

Key observations: open reveals file paths, connect reveals network activity, execve reveals subprocess creation.

ltrace records library calls (above syscalls):

c
Loading…

perf uses hardware counters to find hot paths and encryption routines by CPU time.

For This Exercise

Combining Traces

Write a C program that opens files and allocates memory, then documents what strace, ltrace, and perf would reveal.

Requirements:

Open a file for reading (even if it does not exist, handle the error)
Allocate and free memory with malloc/free
Print documentation explaining what strace would show for these operations
Print documentation explaining what ltrace would show for these operations
Print documentation explaining what perf would show for these operations
Explain how to combine the three tools for effective analysis
Output must contain the keywords the test cases expect

Success Criteria:

Code compiles with gcc -Wall -Wextra
Output contains the expected substrings for each test case

Topic Overview

Tracing Execution with strace, ltrace, and perf

Tool Overview

For This Exercise

Combining Traces

Implementation Task

Progressive Hints

Resources

Open Source

Trace a Binary's Execution with strace, ltrace, and perf

Topic Overview

Tracing Execution with strace, ltrace, and perf

Tool Overview

For This Exercise

Combining Traces

Implementation Task

Progressive Hints

Resources

Open Source