How to find out if a binary uses certain system call on Linux through static analysis? [closed]

Question

I need to find out if a binary is using epoll or select for socket handling on Linux. The binary is not stripped, but I can't run it in my linux box so no strace.

Answer 1

nm <binary> will tell you which symbols are defined and, more importantly here, which symbols are used by the given binary. You can get a conservative guess by checking which of poll or select are listed in the output.

You may find that your application is linked against both. In that case it may be making a run-time decision on which one to call, and you won't be able to easily tell which one it would actually use if you ran it.

Depending on how the binary was built, you may have to run nm with the -D flag; or you may need to ensure you don't specify -D. Try both ways.

If the program uses shared libraries, the actual call to poll or select could be in a library it's using. In that case, you may have to dig through all of its libraries running nm on each of them. You can find out which libraries a program uses with ldd, or if that doesn't work, by looking for the NEEDED entries in the output of readelf --dynamic.

If the binary was built for a different platform than you're currently running on, then ldd won't work, and also you may have to use a cross-compiler build of binutils to get a version of nm that will work for you.