1

dtruss这是我的 macOS 机器上的示例交互。

$ cat main.c
int main() {
  return 0;
}
$ clang main.c
$ sudo dtruss ./a.out
dtrace: system integrity protection is on, some features will not be available

SYSCALL(args)        = return
open("/dev/dtracehelper\0", 0x2, 0x7FFF5AF83930)         = 3 0
ioctl(0x3, 0x80086804, 0x7FFF5AF838B8)       = 0 0
close(0x3)       = 0 0
thread_selfid(0x3, 0x80086804, 0x7FFF5AF838B8)       = 5434813 0
bsdthread_register(0x7FFFAF245080, 0x7FFFAF245070, 0x2000)       = 1073741919 0
ulock_wake(0x1, 0x7FFF5AF830EC, 0x0)         = -1 Err#2
issetugid(0x1, 0x7FFF5AF830EC, 0x0)      = 0 0
mprotect(0x104C7F000, 0x88, 0x1)         = 0 0
mprotect(0x104C81000, 0x1000, 0x0)       = 0 0
mprotect(0x104C97000, 0x1000, 0x0)       = 0 0
mprotect(0x104C98000, 0x1000, 0x0)       = 0 0
mprotect(0x104CAE000, 0x1000, 0x0)       = 0 0
mprotect(0x104CAF000, 0x1000, 0x1)       = 0 0
mprotect(0x104C7F000, 0x88, 0x3)         = 0 0
mprotect(0x104C7F000, 0x88, 0x1)         = 0 0
getpid(0x104C7F000, 0x88, 0x1)       = 34522 0
stat64("/AppleInternal/XBS/.isChrooted\0", 0x7FFF5AF82FA8, 0x1)      = -1 Err#2
stat64("/AppleInternal\0", 0x7FFF5AF83040, 0x1)      = -1 Err#2
csops(0x86DA, 0x7, 0x7FFF5AF82AD0)       = -1 Err#22
dtrace: error on enabled probe ID 2158 (ID 552: syscall::sysctl:return): invalid kernel access in action #10 at DIF offset 40
ulock_wake(0x1, 0x7FFF5AF83050, 0x0)         = -1 Err#2
csops(0x86DA, 0x7, 0x7FFF5AF823B0)       = -1 Err#22

其中许多系统调用看起来很熟悉，但其他系统调用则不然。具体来说，什么是thread_selfid, bsdthread_register, ulock_wake, csops, 和dtrace? 如果这些是系统调用，则它们没有记录它们的手册页。它们是私有系统调用，还是其他？dtruss他们的名字从何而来？

4

1 回答 1

0

是的，ULOCK_wake 是线程 afaik 的私有系统调用的一部分。你可以在 xnu 源代码中看到它是系统调用号 516。

于 2019-02-11T23:21:57.727 回答