3.3.5. Using GDB to intercept application system calls

Procedure

1. Set the catchpoint:

   (gdb) catch syscall syscall-name

   The command catch syscall sets a special type of breakpoint that halts execution when the program performs a system call.

   The syscall-name option specifies the name of the call. You can specify multiple catchpoints for various system calls. Leaving out the syscall-name option causes GDB to stop on any system call.

2. Start execution of the program.

   • If the program has not started execution, start it:

     (gdb) r

   • If the program execution is halted, resume it:

     (gdb) c

3. GDB halts execution after the program performs any specified system call.
4. Use further GDB commands to examine the program state and advance execution, according to the particular situation.

5. To exit the GDB debugging session:

   (gdb) q