Por que o hook de chamada do sistema produz resultados diferentes toda vez no Linux / Android 2.6.29?

Question

Eu implementei o hooking de chamada do sistema para Android 2.6.29 kernel por meio de LKM module . Estou rastreando um aplicativo Android para chamadas do sistema. Mas, curiosamente, ele retorna resultados diferentes toda vez que recebo uma lista de chamadas do sistema.

Não consigo criar negrito na seção de código, por isso coloquei ** para mostrar onde a diferença começa.

Por exemplo,

primeira execução:

our_sys_gettid ---> uid = 10028  
 our_sys_open ---> uid = 10028 with filename= /dev/cpuctl//tasks, flags= 131073, mode=0 
 our_sys_write ---> uid = 10028 with fd= 30, buf = 230 and count=3 
 our_sys_close ---> uid = 10028 with fd= 30  
 our_sys_setpriority ---> uid = 10028 with which= 0, who=230 and niceval=0 
 our_sys_futex ---> uid = 10028 with uadd=������, op=1, val=1, utime=<NULL>, uaddr2=������ and val3=  
 **our_sys_gettid ---> uid = 10028  
 our_sys_open ---> uid = 10028 with filename= /dev/cpuctl//tasks, flags= 131073, mode=0 
 our_sys_clock_gettime ---> uid = 10028 with which_clock=<NULL>, tp =   
 our_sys_clock_gettime ---> uid = 10028 with which_clock=<NULL>, tp =   
 our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=3196467192 
 our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=3196467192 **
 our_sys_clock_gettime ---> uid = 10028 with which_clock=<NULL>, tp =   
 our_sys_clock_gettime ---> uid = 10028 with which_clock=<NULL>, tp =   
 our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=3196466496 
 our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=3196466496 
 our_sys_dup ---> uid = 10028 with fildes=32 
 our_sys_close ---> uid = 10028 with fd= 32  
 .....................

Segunda corrida:

our_sys_gettid ---> uid = 10028  
 our_sys_open ---> uid = 10028 with filename= /dev/cpuctl//tasks, flags= 131073, mode=0 
 our_sys_write ---> uid = 10028 with fd= 30, buf = 228 and count=3 
 our_sys_close ---> uid = 10028 with fd= 30  
 our_sys_setpriority ---> uid = 10028 with which= 0, who=228 and niceval=0 
 our_sys_futex ---> uid = 10028 with uadd=������, op=1, val=1, utime=<NULL>, uaddr2=������ and val3=  
 **our_sys_gettid ---> uid = 10028  
 our_sys_open ---> uid = 10028 with filename= /dev/cpuctl//tasks, flags= 131073, mode=0 
 our_sys_write ---> uid = 10028 with fd= 30, buf = 228 and count=3 
 our_sys_clock_gettime ---> uid = 10028 with which_clock=<NULL>, tp =   
 our_sys_clock_gettime ---> uid = 10028 with which_clock=<NULL>, tp =   
 our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=3198662648 
 our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=3198662648 
 our_sys_clock_gettime ---> uid = 10028 with which_clock=<NULL>, tp =   
 our_sys_clock_gettime ---> uid = 10028 with which_clock=<NULL>, tp =   
 our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=3198661952** 
 our_sys_close ---> uid = 10028 with fd= 30  
 our_sys_setpriority ---> uid = 10028 with which= 0, who=228 and niceval=0 
 our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=1181359656 
 our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=3198661952 
 our_sys_dup ---> uid = 10028 with fildes=32 
 our_sys_close ---> uid = 10028 with fd= 32  
 ....................

Terceira corrida:

our_sys_gettid ---> uid = 10028  
 our_sys_open ---> uid = 10028 with filename= /dev/cpuctl//tasks, flags= 131073, mode=0 
 our_sys_write ---> uid = 10028 with fd= 31, buf = 228 and count=3 
 our_sys_close ---> uid = 10028 with fd= 31  
 our_sys_setpriority ---> uid = 10028 with which= 0, who=228 and niceval=0 
 our_sys_futex ---> uid = 10028 with uadd=������, op=1, val=1, utime=<NULL>, uaddr2=������ and val3=X{�D  
 **our_sys_clock_gettime ---> uid = 10028 with which_clock=<NULL>, tp =   
 our_sys_clock_gettime ---> uid = 10028 with which_clock=<NULL>, tp =   
 our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=3198035960 
 our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=3198035960 
 our_sys_clock_gettime ---> uid = 10028 with which_clock=<NULL>, tp =   
 our_sys_clock_gettime ---> uid = 10028 with which_clock=<NULL>, tp =   
 our_sys_munmap ---> uid = 10028 with addr=1183178752 and len=770048 
 our_sys_close ---> uid = 10028 with fd= 32**  
 our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=3198035264 
 our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=3198035264 
 our_sys_dup ---> uid = 10028 with fildes=31 
 our_sys_close ---> uid = 10028 with fd= 31  
 ........................

Alguma idéia de por que está produzindo resultados diferentes toda vez?

Existe alguma outra ferramenta melhor para rastrear as chamadas do sistema? Eu ouvi falar de strace/ptrace , auditd etc, mas não tenho certeza se eles são utilizáveis para Android ou não.

    

Answer 1

Sugiro que você execute e rastreie seu aplicativo em um dispositivo real em vez de em um emulador. O emulador não possui certas funcionalidades possuídas por um dispositivo real e, portanto, tentar realizar certas tarefas com o emulador realmente produzirá resultados instáveis.