更多解释

例如，许多软件隐藏他们用户注册信息到特殊文件，并且当执行该软件时，首先软件读取该文件并检查许可证。我想知道那个文件在哪里？
我使用./excutedfile.sh从命令行执行文件。现在如何跟踪所有活动。

Answer 1

您可以尝试strace启用过滤功能吗？

$ strace -e trace=open -f gvim
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3 
open("/usr/lib/x86_64-linux-gnu/libgtk-x11-2.0.so.0", O_RDONLY|O_CLOEXEC) = 3
(... snip ...)
open("/usr/lib/x86_64-linux-gnu/libXdmcp.so.6", O_RDONLY|O_CLOEXEC) = 3
open("/proc/filesystems", O_RDONLY)     = 3      
open("/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3
Process 465 attached                             
[pid   464] open("/usr/share/locale/locale.alias", O_RDONLY|O_CLOEXEC) = 5
[pid   464] open("/usr/share/vim/vim74/lang/ja/LC_MESSAGES/vim.mo", O_RDONLY) = 5
[pid   464] open("/usr/lib/x86_64-linux-gnu/gconv/gconv-modules.cache", O_RDONLY) = 5
[pid   464] open("/lib/terminfo/x/xterm-256color", O_RDONLY) = 5
[pid   464] open(".", O_RDONLY)         = 5      
[pid   464] open("/usr/share/vim/vimrc", O_RDONLY) = 5
[pid   464] open(".", O_RDONLY)         = 6      
[pid   464] open("/usr/share/vim/vim74/debian.vim", O_RDONLY) = 6
[pid   464] open("/etc/papersize", O_RDONLY|O_NONBLOCK) = 7
[pid   464] open("/etc/papersize", O_RDONLY) = 7 
[pid   464] open(".", O_RDONLY)         = 6      
[pid   464] open("/usr/share/vim/vim74/syntax/syntax.vim", O_RDONLY) = 6
[pid   464] open(".", O_RDONLY)         = 7      
[pid   464] open("/usr/share/vim/vim74/syntax/synload.vim", O_RDONLY) = 7
[pid   464] open(".", O_RDONLY)         = 8      
[pid   464] open("/usr/share/vim/vim74/syntax/syncolor.vim", O_RDONLY) = 8
(... tons of output ...)

-e trace=open仅选择open(2)系统调用。我还添加了-f来跟踪子进程。

另见：

跟踪和监控包或执行的文件活动？

更多解释

1 个答案: