Snoop interprocess communication

Question

Has anyone tried to create an interprocess message log file? Can someone give me a little advice on the best way to achieve this?

Answer 1

The question is not entirely clear, and the comments make it less clear, but in any case ...

The first two attempts: "nofollow"> ipcs and strace - e trace = ipc .

Answer 2

If you want to register all IPCs (it seems very intense), you should consider using tools.

They have many good tools for this, see PIN in perticular, this section of the manual;

In this example, we will show how to do this more selectively by studying the instructions. This tool generates a trace of all memory addresses that the program refers to. It is also useful for debugging and to simulate a data cache in the processor.

If you are configuring and analyzing a large mass, review the TAU (Configuration and Analysis Utility).

Answer 3

Communication with the kernel driver can take many forms. Usually, a special device file is used for communication, or there may be a special type of socket, for example NETLINK. If you're lucky, there is a character device for which read () and write () are the only means of interaction - if in this case these calls are easily intercepted using various methods. If you're out of luck, many things are done using ioctls or something even more complicated.

However, running 'strace' in a program using the kernel driver for communication can show almost everything it does, although ltrace can be more readable if there are libraries that the program uses for communication. By setting the arguments to 'strace', you can probably get a dump containing only the necessary information:

• First, just close the calls and try to figure out what communication with the kernel means.
• Then add filters to call strace to register only kernel communication calls
• Lastly, make sure strace logs the full lines of all calls, so you don't have to deal with truncated data.

Answers that indicate IPC debugging are probably not relevant, since communication with the kernel is almost never related to IPC (at least not to the various IPC UNIX tools).