Ktrace

From Exterior Memory
Jump to: navigation, search

ktrace is a tool on Mac OS X (and BSD) to log which system call are made by an application. It allows you to get an overview what an application is doing "behind the scenes".

ktrace is replaced with dtrace since Mac OS 10.5. For a ktrace-like tool, use dtruss (a Dtrace script).

ktrace only log system calls: thus function calls to the kernel (hence the name ktrace). This is particularly useful to find out file access by an application, since the open(), read(), write() and close() are all system calls.

Example: Find files written by the system preferences

As an example, I wanted to find out which system configuration files are used to store information on the decimal separator on Mac OS X. I knew these files are written by the "Internationalization" preference pane. Since this is a GUI, rather than an command-line application, I resorted to the "open" command to start the Localization.prefPane.

I made ktrace call the open tool, which then called the preference pane:

sudo ktrace -d open /System/Library/PreferencePanes/Localization.prefPane

This wrote the system calls to a file called ktrace.out. After change a few settings, I closed the preference pane, converted the ktrace.out to a human readable format and opened that (the chmod was needed to make the file readable):

sudo chmod a+r ktrace.out
kdump -f ktrace.out > ktrace.txt
open ktrace.txt

To my surprise, I found that only the open tool was traced, but not the prefpane. This despite the "-d" flag, which tells ktrace to trace children processes as well.

So in my second attempt, I first opened the preference pane manual, and only then started to trace:

open /System/Library/PreferencePanes/Localization.prefPane
ps auxww | grep -i pref

The ps command told me the process ID (PID) of the application I wanted to find:

freek     2080   0.0  1.7   277304  18140  ??  S     5:57pm   0:00.45 
   /Applications/System Preferences.app/Contents/MacOS/System Preferences -psn_0_16384001

So I need to trace PID 2080:

sudo ktrace -d -p 2080
sudo chmod a+r ktrace.out
kdump -f ktrace.out > ktrace.txt

So let's see what was written by the preference pane:

grep -4 -E "(write|wrote)" ktrace.txt | grep NAMI

Resulting in:

 2127 System Preferenc NAMI  "/Users/freek/Library/Preferences/cf#S80AA"
 2127 System Preferenc NAMI  "/Users/freek/Library/Preferences/cf#ej7Ol"
 2127 System Preferenc NAMI  "/Users/freek/Library/Preferences/cf#yf96P"
 2127 System Preferenc NAMI  "/Users/freek/Library/Preferences/cf#KcoUE"
 2127 System Preferenc NAMI  "/Users/freek/Library/Preferences/cf#blXn6"
 2127 System Preferenc NAMI  "/Users/freek/Library/Preferences/cf#x7fu5"
 2127 System Preferenc NAMI  "/Users/freek/Library/Preferences/cf#3pAn1"
 2127 System Preferenc NAMI  "/Users/freek/Library/Preferences/cf#bORFu"
 2127 System Preferenc NAMI  "/Users/freek/Library/Preferences/cf#En7iF"
 2127 System Preferenc NAMI  "/Users/freek/Library/Preferences/cf#oTaZN"
 2127 System Preferenc NAMI  "/Users/freek/Library/Preferences/cf#QPnD1"

Surprise! No regular system files were written. Only these seemingly temporary files. Apparently the programmes have been saved date to a temporary file and then moved to the proper location (that's good programming practice):

grep -1 -E "rename" ktrace.txt
 2127 System Preferenc RET   chmod 0
 2127 System Preferenc CALL  rename(0xbfffe418,0xbfffe82a)
 2127 System Preferenc NAMI  "/Users/freek/Library/Preferences/cf#S80AA"
 2127 System Preferenc NAMI  "/Users/freek/Library/Preferences/.GlobalPreferences.plist"
 2127 System Preferenc RET   rename 0
 2127 System Preferenc CALL  geteuid
--
 2127 System Preferenc RET   chmod 0
 2127 System Preferenc CALL  rename(0xbfffe188,0xbfffe59a)
 2127 System Preferenc NAMI  "/Users/freek/Library/Preferences/cf#ej7Ol"
 2127 System Preferenc NAMI  "/Users/freek/Library/Preferences/com.apple.systempreferences.plist"
 2127 System Preferenc RET   rename 0
 2127 System Preferenc CALL  geteuid

and so on...

So our intuition was right. The localization prefpan writes data to these files:

 2127 System Preferenc NAMI  "/Library/Preferences/.GlobalPreferences.plist"
 2127 System Preferenc NAMI  "/Users/freek/Library/Preferences/.GlobalPreferences.plist"
 2127 System Preferenc NAMI  "/Users/freek/Library/Preferences/com.apple.HIToolbox.plist"
 2127 System Preferenc NAMI  "/Users/freek/Library/Preferences/com.apple.systempreferences.plist"