Can radare2 skip syscall when `db main;dts+;dc`

Question

more detailed see this

In short, I want to skip syscall when recording program, but it seems that the program would always stop after ths syscall.

Hope someone can help me. Thanks.

below is running results:

$ git rev-parse origin/master
093d583000f9f78ec1a4d8643cb59e465a0ede7c
$ git diff origin/master 
diff --git a/libr/main/radare2.c b/libr/main/radare2.c
index 2bc1cb68f9..15ce049d9c 100644
--- a/libr/main/radare2.c
+++ b/libr/main/radare2.c
@@ -1706,7 +1706,7 @@ R_API int r_main_radare2(int argc, const char **argv) {
                        debug = r_config_get_b (r->config, "cfg.debug");
                        if (ret != -1 && r_cons_is_interactive ()) {
                                char *question;
-                               bool no_question_debug = ret & 1;
+                               bool no_question_debug = 1;
$ r2 -NAd -c "db main;dts+;db;dc;dr rip;pd-- 4" /mnt/ubuntu/home/czg/csapp3e/asm/prog
...
0x00401060 - 0x00401061 1 --x sw break enabled valid cmd="" cond="" name="main" module="/mnt/ubuntu/home/czg/csapp3e/asm/prog"
0x7fbe6445b08b
            0x7fbe6445b07e      6690           nop
            ; CALL XREF from map._usr_lib_ld_linux_x86_64.so.2.r_x @ +0x198ae(x)
            ; CALL XREFS from rip @ +0x5238(x), +0x5252(x)
            0x7fbe6445b080      f30f1efa       endbr64
            0x7fbe6445b084      b80c000000     mov eax, 0xc            ; 12
            0x7fbe6445b089      0f05           syscall
            0x7fbe6445b08b      488905e64101.  mov qword [0x7fbe6446f278], rax ; [0x7fbe6446f278:8]=0
            0x7fbe6445b092      4839f8         cmp rax, rdi
        ,=< 0x7fbe6445b095      7209           jb 0x7fbe6445b0a0
        |   0x7fbe6445b097      31c0           xor eax, eax
[0x7fdcd2e4908b]> ds
[0x7fdcd2e4908b]> dr rip
0x7fdcd2e49092

Best regards

Answer 1

I have answered in the github ticket. But I'm copypasting the answer for practical reasons :9 That's the oneliner you want:

r2 -c “dcu main;e dbg.trace=true;dsu -1;dt” -d /bin/ls

Some comments below:

• The dts+ command is used for stepback and dumps/records the state of memory in disk for every step which is not what you want
• dbg.swstep is causing an stack exhaustion if you try to run the whole program ( i need to fix this )
• dsu -1 is the only way you have to perform step until the program is gone. a helper command under dc would be easier to spot
• You cant pass flags after the -d
• No need to analyze the program or avoid home scripts (-NA)
• Use the dtj command to log the traces in json format if you want to post process the execution information
• I would recommend disabling ASLR if you want to do multiple traces and compare them

Also, bear in mind that you can't use dtd if you run the traces until the program dies, because there will be no memory allocated and you cant disassemble . better to continue until a specific address or exit syscall or so.

Another thing is that you are tracing EVERYTHING so you probably want to see other vars like dbg.trace.inrange or dbg.trace.libs to avoid recording instructions from libraries or from sections of the binary that you dont need.