Re: [PATCH 1/4] 'catch syscall' feature -- Architecture-independent part

[Pedro Alves <pedro at codesourcery dot com>]

A Wednesday 05 November 2008 04:09:28, Eli Zaretskii escreveu:
> > From: Pedro Alves <pedro@codesourcery.com>
> > Date: Tue, 4 Nov 2008 22:30:27 +0000
> > Cc: Thiago Jung Bauermann <bauerman@br.ibm.com>,
> >  Eli Zaretskii <eliz@gnu.org>,
> >  =?utf-8?q?S=C3=A9rgio_Durigan_J=C3=BAnior?= <sergiodj@linux.vnet.ibm.com>
> > 
> > On Tuesday 04 November 2008 22:11:27, Thiago Jung Bauermann wrote:
> > > El mar, 04-11-2008 a las 23:12 +0200, Eli Zaretskii escribió:
> > > > Who said that a syscall is necessarily defined by some number?
> > > 
> > > I assumed every OS used numbers to define syscalls ...
> > > 
> > > > More generally, let's say I'd like to implement support for this on
> > > > Windows -- how would I need to go about it?
> > > 
> > > ... but from what you are saying it seems that in Windows it's
> > > different. What's the proper datatype to represent a syscall there?
> > 
> > Depends on what you're calling a syscall on Windows.
> > 
> > If talking about userland->kernel calls, similarly to this
> > new feature, an integer.
> > 
> >  http://www.metasploit.com/users/opcode/syscalls.html
> >  http://www.codeguru.com/cpp/w-p/system/devicedriverdevelopment/article.php/c8035
> > 

> > strace-like tracers on Windows are usually more interested in
> > tracing calls to all kinds of dlls, and they usually do so by
> > playing games with the import tables, I believe.
> 
> I was thinking about the latter, as that is what is usually
> interesting.

Yes, but that falls into api-tracing land, which is a bit different
from syscall tracing.  When using a debugger, if you're going to be
attached to the inferior anyway, it doesn't look like it's much
interesting to have it as a separate feature, and to go play with
import tables.  You can already set breakpoints in the functions you're
interested, and you can already inspect the stack frame with
symbolic data when they're hit, and automatically tell the inferior to
continue.  Perhaps having more scripting power would make
it even easier to use, but well, there's going to be python
for that.

If someone would want to implement "catch syscall" for native
windows, I'd say that some form to catch real syscalls is what
would make more sense, because that's what you can't do with a
regular breakpoint.

-- 
Pedro Alves