How can I track the connection between the process and the terminal?

Question

I have a Linux process developed by a third-party developer that communicates with the terminal. For debugging, I want to see the connection go forward.

You might think that cat will do the trick (to see one direction):

  ./third-party-app & cat /dev/tty 

... but it is not. Rather, cat steal half of the data intended for the application, which is almost useless.

a third-party application is hard-coded to accept /dev/tty .

One of the ways I found spying on a connection is to rename the device /dev/tty , say /dev/real_tty , and create a named pipe named /dev/tty instead. Then do:

  cat /dev/real_tty | tee /dev/tty & 

... at least let me see the result of /dev/real_tty by copying the data from /dev/real_tty into the named pipe /dev/tty and stdout .

This kind of work, but it feels really dodgy and relies on the hype to replace the device. It also does not work in both directions because named pipes carry data in only one direction.

What is the right way to do this?

If anyone is interested, the TTY device is an RS-232 connection with a microcontroller. Information is not sensitive or not protected. All processes (application and spyware) can run as root.

Answer 1

You can watch slsnif . It does exactly what you want, or if you are interested in writing one of them, the source is available to see how it works.

Answer 2

Have you considered using strace / ltrace ? You can see the calls to the system that it makes, in particular, you can see that write / ioctl calls are being made, etc.

Answer 3

RS-232 ? Just touch the RxD / TxD / GND lines with clips. This was forever since I saw that some device even cares about DCD, DTR, etc.

Answer 4

There are several alternatives:

Do it with GDB: Redirecting Output from the Runtime

CryoPID allows you to capture the status of a running process on Linux and save it in a file. Then this file can be used to resume the process later, either after a reboot, or even on another machine.

Distributed MultiThreaded CheckPointing is a tool for transparently monitoring the status of an arbitrary group of distribution programs across many machines and connected by sockets.

Answer 5

To do this, use a script program that uses psudo-terminal. The device /dev/tty usually special and refers to the current process control terminal, so you may not have to resort to renaming things.

script opens the psudo terminal and then starts another instance of your shell with this new shell as the control terminal (therefore /dev/tty refers to this psudo terminal for this shell and its child processes). The -c option allows you to run a specific command, not a shell.

The main problem with the script is that it is impossible to determine how the data received in the output file was ./typescript ( ./typescript by default) - the data coming in both directions is dumped into the same file and similar to what appears on the screen when using the interactive terminal (except for the inclusion of screens, carriage returns and files similar to it, as well as normally displayed characters).

In any case, I know that this question has long been answered, but I thought that if someone searches for a similar solution and does not use a real serial port, this can help them.

Answer 6

Not simple (not for me, at least), but a mechanism that should work for tty serial drivers is a linear discipline .

Answer 7

People here have already made good suggestions, but here is another:

You can also write a shared library with your own write() , which does some work before calling write() from libc.so Then you can use the LD_PRELOAD environment variable to load your library when the process starts.