The Magic of strace

Don't forget it's userspace equiv (strace is syscalls), ltrace. This tracks all lib calls made by process.

Under windows, strace is an SSL/TLS monitoring tool (also hella useful). It shows payloads passed to CryptoAPI/CNG libs so you can easily troubleshoot explicitly encrypted protocols like ldaps. Especially useful if you use client authenticated TLS where is is not possible to use a TLS mitm proxy to snoop the layer 7 data.

Small, somewhat nit-picky critique: the man pages for system calls are in section 2. If you want to see the docs for the "read()" syscall, and not the bash builtin "read", saying "man read" w̶o̶n̶'̶t̶ may not (see follow-up) do what you expect. Instead, you should say

  man 2 read

This should probably be mentioned somewhere.

Otherwise, great writeup. Thanks for sharing!

(edited)

Please see

ftp://86.0.252.89/pub/release/website/tools/trace-20140126-x86_64-b95.tar.gz

This is a tool called ptrace - which does everything that strace does and a lot more. You have working binaries in there, and most of the source - I havent extricated the full build dependencies so it all builds, but this includes extra facilities like reporting summaries of process trees, showing only connections or files, and shlib injection into a target process.

If people are interested more on this, contact me at CrispEditor-a.t-gmail.c-o-m

So what happened with the Lotus system, and how did strace help?

I am a bit paranoid about downloading a binary from a site without a domain name.