Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How to find out where all a closed source application is writing to?

Tags:

c++

c

shell

unix

perl

I have an application (the source for which I don't have), which can be invoked from command line like this

$ ./notmyapp

I want to know all the locations where the application is writing to. It outputs some files in the directory it is being called from, but I need to make sure that those are the only files that are created.

So, I need to isolate the application to find out which all files it created/edited while it was running.

How can I do this?

Some way using Perl or C or C++? Do any of the standard libraries in these languages have ways to do this?

like image 321
Lazer Avatar asked Sep 08 '10 08:09

Lazer


People also ask

Can you see closed source code?

With closed source software (also known as proprietary software), the public is not given access to the source code, so they can't see or modify it in any way. But with open source software, the source code is publicly available to anyone who wants it, and programmers can read or change that code if they desire.

Do it yourself list out the open source and closed source software?

Open source software refers to the computer software which source is open means the general public can access and use. Closed source software refers to the computer software which source code is closes means public is not given access to the source code. 02. Open Source Software in short also referred as OSS.

Who would use a closed source software?

As the user is not provided with the source code, they cannot make changes to the software. Closed source software is usually sold to end users, although sometimes it is available for free. Importantly, when purchasing software, the user does not buy the software itself, but buys a licence to use the software.

Where is application source code stored?

The source code for a computer program is usually stored in text files on the computer's hard disk, or it can be stored in a database.


1 Answers

strace, ktrace/kdump, truss, dtruss, or whatever other program your platform provides for tracing system calls is probably what you're looking for.

Expect lots of output from any of those. To figure out what files the application is reading and writing to, you might want to limit the output to just a few syscalls. strace -eopen ./notmyapp, for example.

The application might also fork off child processes to do some of its work. With most system call tracers, you'll have to be specific about tracing those child processes as well. With strace, that'd be strace -f ./notmyapp.

like image 154
rafl Avatar answered Oct 29 '22 06:10

rafl