Trace execve and execveat

December 17, 2023

建议 Tips

您正在查看印刷版本的博客, 印刷版本的博客可能会缺少部分交互功能, 部分内容显示不全或过时. 如果您在查看该印刷版博客时遇到了任何问题, 欢迎来此链接查看在线版: https://www.kxxt.dev/notes/trace-execve-and-execveat/

You are viewing a printed version of this blog. It may lack some interactive features and some content might now be fully displayed or outdated. If you encounter any problems while viewing this printed version of the blog, feel free to view the online version here: https://www.kxxt.dev/notes/trace-execve-and-execveat/

Use old school strace:


strace -Y -f -qqq -s99999 -e trace=execve,execveat <command>

Or an alternative I wrote in Rust (prettier output): https://github.com/kxxt/tracexec


tracexec log --show-cmdline -- <command>