Dynamic tracing within a busybox environment
summary
Shows how to do kernel-level dynamic tracing on a constrained busybox system using only echo and cat to control tracefs and ftrace, plus small shell scripts. Demonstrates using set_event_pid and set_ftrace_pid, tracers, event groups and synthetic events to correlate enter/exit data, and eprobes to dereference user strings. Examples: ls generates ~15,000 function events with no loss; ring buffer counters show lost events when overflowed; dropbear wakes four times matching four TCP packets. Host-side libtrace tools and a tar-ish copy trick complete the workflow.
AI-written summary · about
chapters (40)
- 0:00Intro
- 2:48Pseudo file systems
- 4:03Ftrace files
- 5:03Tracers
- 5:25Busybox tracers
- 7:42Events
- 8:19Scheduling tasks
- 9:49Enabling tracing
- 10:28Do trace task
- 11:47Do trace function
- 11:57Do trace tasks
- 12:19Event fork
- 13:59Parent tracing
- 14:26System calls
- 14:36System calls walkthrough
- 15:20Clearing trace events
- 16:11No trace pid
- 17:26Parent child tracing
- 18:19Interrupt fields
- 19:48Repeat in trace
- 20:00Stack trace trigger
- 20:13Stack trace explanation
- 21:08Function tracer explanation
- 21:24Wakeup events
- 22:00More information
- 22:30Event Probes
- 23:06Event Probe Example
- 24:09Event Probe Group
- 24:20File Names
- 24:32Exec
- 24:44Fault
- 25:56Example
- 26:33Synthetic events
- 27:04How does synthetic events work
- 29:48Faulted file
- 30:24Complex
- 30:36Userspace
- 33:15Tracing Directory
- 34:45Hack
- 36:00Shell script
related talks
34mTracing: The Bane of You Security Folks
19mDTrace and eBPF: new challenges
32mListen to your Engine
48mDPTrace: Dual Purpose Trace for Exploitability Analysis of Program Crashes
32mChallenges of Deploying eBPF-based Tracing in Embedded Systems, and Alternatives in Embe...
30mxprobes: Hybrid User/Kernel eBPF Probes for Cross-Layer Observability
31mTracing, Profiling & Debugging in Production (eBPF)
32mContainer Escape Paths Nobody Monitors: Abusing Linux Debug Interfaces