From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 31326 invoked by alias); 5 Nov 2008 12:29:15 -0000 Received: (qmail 31263 invoked by uid 22791); 5 Nov 2008 12:29:14 -0000 X-Spam-Check-By: sourceware.org Received: from mail.codesourcery.com (HELO mail.codesourcery.com) (65.74.133.4) by sourceware.org (qpsmtpd/0.31) with ESMTP; Wed, 05 Nov 2008 12:28:21 +0000 Received: (qmail 20298 invoked from network); 5 Nov 2008 12:28:19 -0000 Received: from unknown (HELO orlando.local) (pedro@127.0.0.2) by mail.codesourcery.com with ESMTPA; 5 Nov 2008 12:28:19 -0000 From: Pedro Alves To: gdb-patches@sourceware.org, Eli Zaretskii Subject: Re: [PATCH 1/4] 'catch syscall' feature -- =?iso-8859-1?q?=09Architecture-independent=09part?= Date: Wed, 05 Nov 2008 12:29:00 -0000 User-Agent: KMail/1.9.10 Cc: bauerman@br.ibm.com, sergiodj@linux.vnet.ibm.com References: <1225773079.24532.52.camel@miki> <200811042230.27666.pedro@codesourcery.com> In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline Message-Id: <200811051228.29626.pedro@codesourcery.com> X-IsSubscribed: yes Mailing-List: contact gdb-patches-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: gdb-patches-owner@sourceware.org X-SW-Source: 2008-11/txt/msg00074.txt.bz2 A Wednesday 05 November 2008 04:09:28, Eli Zaretskii escreveu: > > From: Pedro Alves > > Date: Tue, 4 Nov 2008 22:30:27 +0000 > > Cc: Thiago Jung Bauermann , > > Eli Zaretskii , > > =3D?utf-8?q?S=3DC3=3DA9rgio_Durigan_J=3DC3=3DBAnior?=3D > >=20 > > On Tuesday 04 November 2008 22:11:27, Thiago Jung Bauermann wrote: > > > El mar, 04-11-2008 a las 23:12 +0200, Eli Zaretskii escribi=F3: > > > > Who said that a syscall is necessarily defined by some number? > > >=20 > > > I assumed every OS used numbers to define syscalls ... > > >=20 > > > > More generally, let's say I'd like to implement support for this on > > > > Windows -- how would I need to go about it? > > >=20 > > > ... but from what you are saying it seems that in Windows it's > > > different. What's the proper datatype to represent a syscall there? > >=20 > > Depends on what you're calling a syscall on Windows. > >=20 > > If talking about userland->kernel calls, similarly to this > > new feature, an integer. > >=20 > > http://www.metasploit.com/users/opcode/syscalls.html > > http://www.codeguru.com/cpp/w-p/system/devicedriverdevelopment/article= .php/c8035 > >=20 > > strace-like tracers on Windows are usually more interested in > > tracing calls to all kinds of dlls, and they usually do so by > > playing games with the import tables, I believe. >=20 > I was thinking about the latter, as that is what is usually > interesting. Yes, but that falls into api-tracing land, which is a bit different from syscall tracing. When using a debugger, if you're going to be attached to the inferior anyway, it doesn't look like it's much interesting to have it as a separate feature, and to go play with import tables. You can already set breakpoints in the functions you're interested, and you can already inspect the stack frame with symbolic data when they're hit, and automatically tell the inferior to continue. Perhaps having more scripting power would make it even easier to use, but well, there's going to be python for that. If someone would want to implement "catch syscall" for native windows, I'd say that some form to catch real syscalls is what would make more sense, because that's what you can't do with a regular breakpoint. --=20 Pedro Alves