我已经通过Android 2.6.29为LKM module内核实现了系统调用挂钩。我正在寻找一个用于系统调用的Android应用程序。但有趣的是，每次获得系统调用列表时，它都会返回不同的结果。
我无法在代码部分制作粗体文字，因此我将**用于显示差异的开始位置。
例如，
首先运行：
our_sys_gettid ---> uid = 10028
our_sys_open ---> uid = 10028 with filename= /dev/cpuctl//tasks, flags= 131073, mode=0
our_sys_write ---> uid = 10028 with fd= 30, buf = 230 and count=3
our_sys_close ---> uid = 10028 with fd= 30
our_sys_setpriority ---> uid = 10028 with which= 0, who=230 and niceval=0
our_sys_futex ---> uid = 10028 with uadd=������, op=1, val=1, utime=<NULL>, uaddr2=������ and val3=
**our_sys_gettid ---> uid = 10028
our_sys_open ---> uid = 10028 with filename= /dev/cpuctl//tasks, flags= 131073, mode=0
our_sys_clock_gettime ---> uid = 10028 with which_clock=<NULL>, tp =
our_sys_clock_gettime ---> uid = 10028 with which_clock=<NULL>, tp =
our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=3196467192
our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=3196467192 **
our_sys_clock_gettime ---> uid = 10028 with which_clock=<NULL>, tp =
our_sys_clock_gettime ---> uid = 10028 with which_clock=<NULL>, tp =
our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=3196466496
our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=3196466496
our_sys_dup ---> uid = 10028 with fildes=32
our_sys_close ---> uid = 10028 with fd= 32
.....................
第二轮：
our_sys_gettid ---> uid = 10028
our_sys_open ---> uid = 10028 with filename= /dev/cpuctl//tasks, flags= 131073, mode=0
our_sys_write ---> uid = 10028 with fd= 30, buf = 228 and count=3
our_sys_close ---> uid = 10028 with fd= 30
our_sys_setpriority ---> uid = 10028 with which= 0, who=228 and niceval=0
our_sys_futex ---> uid = 10028 with uadd=������, op=1, val=1, utime=<NULL>, uaddr2=������ and val3=
**our_sys_gettid ---> uid = 10028
our_sys_open ---> uid = 10028 with filename= /dev/cpuctl//tasks, flags= 131073, mode=0
our_sys_write ---> uid = 10028 with fd= 30, buf = 228 and count=3
our_sys_clock_gettime ---> uid = 10028 with which_clock=<NULL>, tp =
our_sys_clock_gettime ---> uid = 10028 with which_clock=<NULL>, tp =
our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=3198662648
our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=3198662648
our_sys_clock_gettime ---> uid = 10028 with which_clock=<NULL>, tp =
our_sys_clock_gettime ---> uid = 10028 with which_clock=<NULL>, tp =
our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=3198661952**
our_sys_close ---> uid = 10028 with fd= 30
our_sys_setpriority ---> uid = 10028 with which= 0, who=228 and niceval=0
our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=1181359656
our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=3198661952
our_sys_dup ---> uid = 10028 with fildes=32
our_sys_close ---> uid = 10028 with fd= 32
....................
第三次运行：
our_sys_gettid ---> uid = 10028
our_sys_open ---> uid = 10028 with filename= /dev/cpuctl//tasks, flags= 131073, mode=0
our_sys_write ---> uid = 10028 with fd= 31, buf = 228 and count=3
our_sys_close ---> uid = 10028 with fd= 31
our_sys_setpriority ---> uid = 10028 with which= 0, who=228 and niceval=0
our_sys_futex ---> uid = 10028 with uadd=������, op=1, val=1, utime=<NULL>, uaddr2=������ and val3=X{�D
**our_sys_clock_gettime ---> uid = 10028 with which_clock=<NULL>, tp =
our_sys_clock_gettime ---> uid = 10028 with which_clock=<NULL>, tp =
our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=3198035960
our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=3198035960
our_sys_clock_gettime ---> uid = 10028 with which_clock=<NULL>, tp =
our_sys_clock_gettime ---> uid = 10028 with which_clock=<NULL>, tp =
our_sys_munmap ---> uid = 10028 with addr=1183178752 and len=770048
our_sys_close ---> uid = 10028 with fd= 32**
our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=3198035264
our_sys_ioctl ---> uid = 10028 with fd=21, cmd=3222823425 and arg=3198035264
our_sys_dup ---> uid = 10028 with fildes=31
our_sys_close ---> uid = 10028 with fd= 31
........................
知道为什么每次都会产生不同的结果吗？
还有其他更好的工具来跟踪系统调用吗？我听说过strace/ptrace，auditd等，但不确定它们是否适用于Android。