Linux — Why “ltrace” does not work on new versions of Ubuntu?

Many folks have asked me about that, so I have decided to write a short answer about it. Two well known command line tools on Linux which can help with dynamic analysis are “strace” and “ltrace”. “strace” allows tracing of system calls (“man 2 syscalls”) and signals (“man 7 signal”). I am not going to focus on “strace” in this writeup, you can read more about it using “man strace”.

On the other hand, “ltrace” allows the tracing of dynamic library calls and signals received by the traced process (“man 1 ltrace”). Moreover, it can also trace syscalls (like “strace”) if you are using the “-S” flag.

If you have tried using “ltrace” in the new versions of Ubuntu you probably saw that the library calls are not shown (you can verify it using “ltrace `which ls`”). In order to demonstrate that I have created a small c program — as you can see in the screenshot below (“code.c”).

First, if we compile “code.c” and run it using “ltrace” we don’t get any information about a library call (see in the screenshot below). Second, if we compile “code.c” with “-z lazy” we can see when running the executable with “ltrace” we do get information about the library functions. So what is the difference between the two?

“ltrace” (and “strace”) works by inserting a breakpoint in the PLT for the relevant symbol (that is library function) we want to trace. I have explained about breakpoints in a previous writeup that you can read in the following like — https://medium.com/@boutnaru/have-you-ever-asked-yourself-how-breakpoints-work-c72dd8619538. So because by default the binaries are not compiled with “lazy loading” of symbols they are resolved when the application starts and thus the breakpoints set by “ltrace” are not triggered (and we don’t see any library calls in the output — as shown in the screenshot below). Also, you can read more about the internals of “ltrace” here — https://www.kernel.org/doc/ols/2007/ols2007v1-pages-41-52.pdf

See you in my next writeup ;-)

You can follow me on twitter — @boutnaru (https://twitter.com/boutnaru).