Lion Cipher Lab
See exactly what a program does with strace
- Foundations
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Every interesting thing a program does, it does by asking the kernel. Touch a file, send a packet, spawn a child, read the clock, allocate memory from the OS — each is a SYSTEM CALL, a controlled jump from the program's own code (user space) into the kernel, which is the only code allowed to touch hardware and other processes. That boundary is the one place where a program's private intentions become observable actions, and strace lets you sit exactly on it and watch every crossing live. This is why strace is three tools at once. It is the debugger of last resort: when a program fails with a…
What you'll learn
- understanding the user-space / kernel boundary and what a system call is
- reading strace output: syscall name, arguments, and return value
- watching a normal program open, read, write and close files (openat/read/write/close)
- following child processes across fork/clone with strace -f
- proving a program touched the network by watching connect/sendto/recvfrom
- listing every file a program opens to debug 'why can't it find its config'
- profiling a process with strace -c to see where its syscall time goes
- attaching strace to an already-running process with -p PID
- using strace as first-pass dynamic analysis to answer 'what does this binary actually do'
- knowing strace's limits: overhead, blindness to CPU-bound work, ptrace restrictions, and when to reach for ltrace or eBPF/bpftrace instead
Steps in this lab
- The one idea: a program only touches the world through system calls
- Get a Linux shell and install strace
- strace ls — watch a program open, read and write
- strace -f — follow the children a program spawns
- Prove a program hit the network: strace -e trace=network curl
- Every file it opens: the 'why can't it find its config' debugging superpower
- strace -c — profile it: which syscalls dominate?
- Attach to something already running: strace -p PID
- The judgment: when strace is the right tool, and when it lies to you
- macOS, Windows, and what you actually learned