Function 59 - trace last system calls.
Gets data on all system calls of all processes.
Parameters:
- eax = 59 - function number
- ebx = 0 - unique subfunction
- ecx = pointer to the buffer
- edx = size of the buffer
Returned value:
- eax = total number of system calls made from system boot
(modulo 2^32)
- ebx = 0
Format of information on one call: (size = 0x40 = 64 bytes)
- +0: dword: PID of process/thread
- +4: 7*dword: garbage
- +32 = +0x20: dword: value of edi at the call
- +36 = +0x24: dword: esi
- +40 = +0x28: dword: ebp
- +44 = +0x2C: dword: stack pointer of the kernel handler
- +48 = +0x30: dword: ebx
- +52 = +0x34: dword: edx
- +56 = +0x38: dword: ecx
- +60 = +0x3C: dword: eax (=number of system function)
Remarks:
- The function is used only in the application 'systrace'.
It is rather difficult to imagine a situation, in which
this application or this function are really useful;
and all system calls for support of this function are a little
decelerated (though not strongly)...
- So there is a proposition to delete from the kernel
support of this function, together with application 'systrace'.
- The information on system calls saves in the system
ring buffer with 0x10 entries.
This function simply copies the given size of data
from this buffer to the given address.
- One can determine, which entry in the buffer corresponds to
last system call, by value of eax, namely, it is the entry
(eax and 0xF) (at offset (eax and 0xF)*0x40).
- In the current implementation there can be the seldom
meeting problems of unsynchronization, when the information
on some calls becomes outdated.
- Under the system buffer one page, 4Kb, is allocated.
Size of an entry = 64 bytes. Why only 16 entries are used,
is not clearly.
- The value of esp at the moment of system call cannot
be determined by this function.
- The current implementation does not check edx for correctness.