// 自定義動(dòng)態(tài)庫代碼（hook.c）
#define _GNU_SOURCE
#include <stdio.h>
#include <dlfcn.h>

// 定義原函數(shù)指針
typedef int (*orig_puts_type)(const char*);

int puts(const char* str) {
    // 獲取原函數(shù)地址
    orig_puts_type orig_puts = (orig_puts_type)dlsym(RTLD_NEXT, "puts");
    // 監(jiān)控邏輯：打印參數(shù)
    printf("[監(jiān)控] 調(diào)用 puts(\"%s\")\n", str);
    // 調(diào)用原函數(shù)并返回結(jié)果
    return orig_puts(str);
}

int puts(const char* str) {
    orig_puts_type orig_puts = (orig_puts_type)dlsym(...);
    int ret = orig_puts(str);
    printf("[監(jiān)控] 返回值為 %d\n", ret);
    return ret;
}

gcc -shared -fPIC -o libhook.so hook.c -ldl

LD_PRELOAD=./libhook.so ./target_program

# Debian/Ubuntu
sudo apt-get install ltrace

# RHEL/CentOS
sudo yum install ltrace

ltrace [選項(xiàng)] <可執(zhí)行文件> [程序參數(shù)]  

# 基礎(chǔ)跟蹤
ltrace ./your_program

# 跟蹤指定進(jìn)程
ltrace -p <PID>

# 輸出到文件
ltrace -o debug.log ./server

# 監(jiān)控內(nèi)存相關(guān)函數(shù)
ltrace -e "malloc+free" ./memory_test

# 輸出示例
malloc(1024)         = 0x14762a0
free(0x14762a0)      = <void>

ltrace ./network_tool  # 默認(rèn)顯示所有庫函數(shù)調(diào)用

fopen("config.ini", "r")       = 0x7f8a5c00b8a0  # 函數(shù)名+參數(shù) → 返回值
strlen("Hello")                = 5               # 字符串長(zhǎng)度計(jì)算
gettimeofday(0x7ffd8943f370, NULL) = 0           # 時(shí)間獲取調(diào)用

ltrace -c ./algorithm

# 輸出示例
% time     seconds  usecs/call     calls  函數(shù)
 35.21    0.004235         105        40   malloc
 28.17    0.003387          84        40   free
 20.04    0.002410          60        40   strlen

# 檢查 SSL 庫調(diào)用
ltrace -e "SSL_*" ./https_client

# 典型問題：未調(diào)用 SSL_shutdown
SSL_new(0x7f1344000ac0)          = 0x152c300
SSL_connect(0x152c300)           = -1

# 監(jiān)控文件操作
ltrace -e "fopen+fclose" ./uploader

# 可疑行為示例
fopen("/etc/passwd", "r")        = 0x173da20

ltrace ./encryption_tool | grep AES_
AES_set_encrypt_key("secret", 128, 0x7ffc52a3fb10) = 0
AES_cbc_encrypt(0x7ffc52a3fb90, 0x173da20, 64, ...) = <void>

ltrace -cS ./image_processor | sort -nrk 1
# 結(jié)果顯示 80% 時(shí)間消耗在 libjpeg 的 jpeg_write_scanlines()

ltrace -f -e 'f*' -tt -o libc.log ./multithread_app  # 追蹤所有以f開頭的函數(shù)，記錄子進(jìn)程與時(shí)間戳

fopen("config.json", "r")                     = 0  # 返回NULL指針，實(shí)際應(yīng)檢查errno
printf("%s", 0x55a1a2e2e260)                  = -1 # 參數(shù)類型不匹配導(dǎo)致失敗

ltrace -p 1234 -e fprintf  # 附加到PID 1234并監(jiān)控fprintf調(diào)用

ltrace -e 'libssl.so*' ./https_client  # 追蹤OpenSSL庫所有函數(shù)

ltrace -f -i ./multithread_server  # 跟蹤多線程并顯示指令指針

ltrace -e malloc,free ./memory_app

##################輸出示例######################################
malloc(1024)            = 0x55a1a2e2e260  # 分配1KB內(nèi)存
free(0x55a1a2e2e260)    = <void>          # 釋放內(nèi)存

ltrace -e strcpy,strlen ./string_processor

#########輸出示例#################

strlen("Hello")                              = 5
strcpy(0x7ffd4a3d4e60, "World")              = 0x7ffd4a3d4e60  # 復(fù)制字符串

ltrace -e fopen,fread,fclose ./file_reader

#######示例輸出############################

fopen("data.bin", "rb")                      = 0x55a1a2e2e290  # 打開文件
fread(0x7ffd4a3d4e60, 1, 4096, 0x55a1a2e2e290) = 1024           # 讀取1024字節(jié)
fclose(0x55a1a2e2e290)                       = 0               # 關(guān)閉文件

ltrace -c -e pow,sqrt ./math_solver          # -c 統(tǒng)計(jì)調(diào)用次數(shù)與耗時(shí)

#########輸出##################
% time   seconds  usecs/call   calls   function
------ ----------- ----------- ------ ------------
 68.2    0.420105     4201        100    pow
 31.8    0.196200     1962        100    sqrt

ltrace -e gethostbyname,connect ./network_client

#########輸出###################################

gethostbyname("example.com")                 = 0x55a1a2e2e350  # DNS解析
connect(3, {sa_family=AF_INET, sin_port=htons(80)...}, 16) = 0  # TCP連接

ltrace -c ./image_processor  # 輸出函數(shù)調(diào)用統(tǒng)計(jì)表


############輸出#################

% time   seconds  usecs/call   calls   function
------ ----------- ----------- ------ ------------
 45.3    1.20210      1202      1000    malloc
 30.1    0.80105       801      1000    free
 24.6    0.65300       653      1000    memcpy

ltrace -T ./encryption_tool

########輸出#####################

AES_encrypt(0x7ffd4a3d4e60, 0x7ffd4a3d4f60, 0x55a1a2e2e290) = <void> <3.142000>  # 單次加密耗時(shí)3.1秒