1 00:00:00,001 --> 00:00:05,002 (upbeat music) 2 00:00:05,002 --> 00:00:07,007 - [Instructor] All right, I hope you were ready for those, 3 00:00:07,007 --> 00:00:09,008 kind of tricky. 4 00:00:09,008 --> 00:00:13,002 So first of all, we wanted to look at 5 00:00:13,002 --> 00:00:16,008 how to get strace to just summarize, you know, 6 00:00:16,008 --> 00:00:20,009 to count the number of system calls. 7 00:00:20,009 --> 00:00:26,003 So if we did a man on strace, 8 00:00:26,003 --> 00:00:33,007 and maybe we looked for count, keep searching, 9 00:00:33,007 --> 00:00:37,004 right there, it says -c 10 00:00:37,004 --> 00:00:39,006 so let's try that. 11 00:00:39,006 --> 00:00:43,002 So we do strace -c 12 00:00:43,002 --> 00:00:46,004 and we want to see date command. 13 00:00:46,004 --> 00:00:49,004 And if we look through that number of calls, 14 00:00:49,004 --> 00:00:55,009 the most number of calls was 31 for the open at system call. 15 00:00:55,009 --> 00:01:00,003 And then we got a lot of single calls and so forth. 16 00:01:00,003 --> 00:01:03,007 It's sorted by percentage of time. 17 00:01:03,007 --> 00:01:08,002 Alright, the next thing is we want to strace 18 00:01:08,002 --> 00:01:09,007 the cd command. 19 00:01:09,007 --> 00:01:12,000 This is tricky. 20 00:01:12,000 --> 00:01:15,006 If we say whereis cd. 21 00:01:15,006 --> 00:01:20,000 Turns out there's no executable program for cd. 22 00:01:20,000 --> 00:01:21,007 This is important. 23 00:01:21,007 --> 00:01:25,002 CD does map to a system call, 24 00:01:25,002 --> 00:01:29,004 but changing directory is something that changes 25 00:01:29,004 --> 00:01:32,004 the state of your shell. 26 00:01:32,004 --> 00:01:35,004 When you have an ordinary executable command, 27 00:01:35,004 --> 00:01:37,002 the shell will start a new process, 28 00:01:37,002 --> 00:01:39,006 like for the date command, it starts a new process 29 00:01:39,006 --> 00:01:42,000 and the new process runs date. 30 00:01:42,000 --> 00:01:45,000 If we started a new process to change directory, 31 00:01:45,000 --> 00:01:47,001 that process would change directory. 32 00:01:47,001 --> 00:01:50,006 So cd is built into the shell. 33 00:01:50,006 --> 00:01:56,008 So we can't just strace the cd command. 34 00:01:56,008 --> 00:01:58,006 So here's a little script, 35 00:01:58,006 --> 00:02:02,002 a one-liner, change directory to /lookforme. 36 00:02:02,002 --> 00:02:03,003 There is no such directory, 37 00:02:03,003 --> 00:02:08,003 but we're going to have something easy to grep for. 38 00:02:08,003 --> 00:02:13,000 Now we can't even strace that 39 00:02:13,000 --> 00:02:16,000 because it's not a real executable. 40 00:02:16,000 --> 00:02:19,009 We have to strace bash, strace bash 41 00:02:19,009 --> 00:02:24,004 or some other shell that's going to interpret that. 42 00:02:24,004 --> 00:02:26,001 And then it all works. 43 00:02:26,001 --> 00:02:29,003 If we do it again and we grep 44 00:02:29,003 --> 00:02:33,006 and I'm running bash here, so I'm doing pipe ampersand 45 00:02:33,006 --> 00:02:36,002 and in case you haven't seen that before, 46 00:02:36,002 --> 00:02:41,004 pipe ampersand captures both the standard output 47 00:02:41,004 --> 00:02:44,006 and the standard error of the command on the left. 48 00:02:44,006 --> 00:02:48,004 And it turns out strace prints its trace output, 49 00:02:48,004 --> 00:02:50,001 the standard error. 50 00:02:50,001 --> 00:02:51,004 So if we just put a pipe, 51 00:02:51,004 --> 00:02:55,008 we wouldn't be piping the output of strace into it 52 00:02:55,008 --> 00:03:01,001 and we want to grep lookforme. 53 00:03:01,001 --> 00:03:03,006 And there we see some reads 54 00:03:03,006 --> 00:03:06,009 'cause it was reading the script file 55 00:03:06,009 --> 00:03:09,008 and then we did a fs stat thing. 56 00:03:09,008 --> 00:03:10,008 That doesn't look like it. 57 00:03:10,008 --> 00:03:12,009 But then there's something called chdir. 58 00:03:12,009 --> 00:03:13,009 That's probably it. 59 00:03:13,009 --> 00:03:17,001 For some reason it tried to do it twice 60 00:03:17,001 --> 00:03:18,007 and then it got an error message about that. 61 00:03:18,007 --> 00:03:21,003 So it looks like the system called a change directory 62 00:03:21,003 --> 00:03:25,000 is called chdir. 63 00:03:25,000 --> 00:03:28,005 And then we had a challenge 64 00:03:28,005 --> 00:03:31,008 to see whether it's the shell 65 00:03:31,008 --> 00:03:34,005 or it's the command itself 66 00:03:34,005 --> 00:03:39,005 that opened up a file when you do redirection. 67 00:03:39,005 --> 00:03:43,001 So let's see, got a little script here. 68 00:03:43,001 --> 00:03:46,000 Date command, redirecting it to output to dev/null. 69 00:03:46,000 --> 00:03:48,009 So who opens dev/null? 70 00:03:48,009 --> 00:03:52,001 So we're going to do strace -follow 71 00:03:52,001 --> 00:03:57,003 so that we see the date command running also and trace that. 72 00:03:57,003 --> 00:04:02,001 And then we want the output of strace to go into a file. 73 00:04:02,001 --> 00:04:06,008 That'll be easier to look through than using grep I think. 74 00:04:06,008 --> 00:04:08,005 And then that's a script. 75 00:04:08,005 --> 00:04:13,006 So we'll run it with bash, right? 76 00:04:13,006 --> 00:04:16,009 And then we look at strace.out 77 00:04:16,009 --> 00:04:23,000 and we look for the dev/null 78 00:04:23,000 --> 00:04:27,003 and we see it's being opened right here. 79 00:04:27,003 --> 00:04:33,009 And that's happening before the date program is executed. 80 00:04:33,009 --> 00:04:37,003 So the shell opens that up 81 00:04:37,003 --> 00:04:40,008 and when we exec the date program, 82 00:04:40,008 --> 00:04:43,005 it inherits that open file. 83 00:04:43,005 --> 00:04:45,000 Kind of cool.