dannykopping / b3 Goto Github PK

when b3 try to parse this instruction i get this error

arch_prctl(0x3001 /* ARCH_??? */, 0x7ffe4887f480) = -1 EINVAL (Invalid argument)

[PARSE ERROR] SyntaxError: Expected [0-9] but "A" found.

the full command here

strace -f ./a.out |& b3  -s
{"syscall":"execve","args":["./a.out",["./a.out"],140724292233112,"..."],"result":0,"timing":null,"pid":null,"type":"SYSCALL"}
{"syscall":"brk","args":[],"result":32165888,"timing":null,"pid":null,"type":"SYSCALL"}
[PARSE ERROR] SyntaxError: Expected [0-9] but "A" found.

it seem odd, because the instruction look complete (maybe the comment in the first parameter is the reason).

maybe in case of result equal -1 it might be possible to give the errno value

arch_prctl(0x3001 , 0x7ffe4887f480) = -1 EINVAL (Invalid argument)

in this case the result will be

{
   "syscall": "arch_prctl",
   "args": [
      12289,
      [],
      140730115290240
   ],
   "result": "-1 EINVAL (Invalid argument)1",
   "timing": null,
   "pid": null,
   "type": "SYSCALL"
}

maybe, result could be an object with the returned value.
something like

{
   "syscall": "arch_prctl",
   "args": [
      12289,
      [],
      140730115290240
   ],
   "result": {
      "value": -1,
      "errno": "EINVAL"
      "comment": "Invalid argument"
   },
   "timing": null,
   "pid": null,
   "type": "SYSCALL"
}

Is nexe really needed as a regular dependency?

Seems to fail to parse with timing information.

eg

This works.
strace -f cat

The following fail to produce any output.
strace -t -f cat
strace -tt -f cat
strace -ttt -f cat

may be link with #5
seem that if there is more than one element in an array ints are not parsed
(if there is only one int it is parsed)
here a strace of a program with a select

 > ./strace a.out
select(255, [0], [1 2], [0 1 2], {tv_sec=0, tv_usec=962357}) = 2 (out [1 2], left {tv_sec=0, tv_usec=962344})

which will produce

{
   "syscall": "select",
   "args": [
      255,
      [
         0
      ],
      [
         "1",
         "2"
      ],
      [
         "0",
         "1",
         "2"
      ],
      {
         "tv_sec": 0,
         "tv_usec": 962357
      }
   ],
   "result": "2 (out [1 2], left {tv_sec=0, tv_usec=962344})",
   "timing": null,
   "pid": null,
   "type": "SYSCALL"
}

if we look at the args array, the second parameter is an array of integer but the third parameter is an array of strings.

Thanks for this module it's really useful.

When strace reports a success on the system call it prints the return code without a message. When it print an error it reports a text string with it. This seems to adjust the field data type in the json output

eg

Its an int here.

{"syscall":"read","args":[3,"",4096],"result":0,"timing":0.000004,"pid":null,"type":"SYSCALL"}

But string here.

{"syscall":"read","args":[0,140678528360448,131072],"result":"-1 EAGAIN (Resource temporarily unavailable)","timing":0.043223,"pid":null,"type":"SYSCALL"}

Sometimes these also return a pointer as well...

{"syscall":"mmap","args":[null,281016,["PROT_READ"],["MAP_PRIVATE"],3,0],"result":140517931040768,"timing":0.000008,"pid":null,"type":"SYSCALL"}