How to trace the current instruction pointer of an executable dependent on shared libraries?
0
votes
0
answers
69
views
I would like to trace the api calls made by an executable to the linked shared libraries. When the libraries are complied with the executable, I can trace function calls using python's Ptrace debugger. But **when the executable is linked with shared libraries each time instruction pointer is random** so I couldn't be able to trace the api calls. I read that due to ASLR this address is random each time.
Steps followed to trace function calls:
- Got the function address from the elf file
- Got the Instruction pointer by linking pid with ptrace debugger
- Matched instruction pointer and function address to get the function call made.
I also read that shared libraries are compiled with position independent flag, so it will the linked with PLT table in runtime.
Is there any other way to get the next instruction pointer and match it with function address to trace each function call made to shared library?
Asked by raghul
(1 rep)
Sep 18, 2024, 05:53 PM