I need to catch mprotect syscalls that is not originating from libc, how can I do that?
I'm not sure if gdb can filter the library names:
Catchpoint 2 (call to syscall mprotect), 0x00007ffff74cde57 in mprotect () from /lib64/libc.so.6
I need to catch mprotect syscalls that is not originating from libc, how can I do that?
I'm not sure if gdb can filter the library names:
Catchpoint 2 (call to syscall mprotect), 0x00007ffff74cde57 in mprotect () from /lib64/libc.so.6
I need to catch mprotect syscalls that is not originating from libc
You could likely achieve almost the desired result by filtering out mprotect calls originating from the particular address in libc.so.6 -- most calls should be coming from that address:
(gdb) cond 2 $rip != 0x00007ffff74cde57
If that's not good enough, you should be able to use embedded Python to evaluate arbitrary conditions once catchpoint is reached, using the Breakpoint.stop function.