Reverse › Module 6 › Lesson 3
Trace Observe
Trace and observe literacy — logging execution, strace/ltrace, GDB logging, and bounded stepping on $RE_LAB without infinite trace dumps.
Visual · t23_trace_observe
Trace/observe = bounded dynamic observation. $RE_LAB. Original Cyberlium.
Opening
Tracing every instruction is how disks die — learn bounded observation on YOUR crackme, not full-system traces on production.
Trace and observe techniques capture what a binary does at runtime without manual stepping every instruction: strace for syscalls, ltrace for library calls, GDB set logging on, record/replay where available, and bounded step counts between breakpoints. Analyst literacy reads open/read/write/connect patterns, library strcmp calls, and anti-debug syscall pairs — enough for CTF writeups and malware class notes. Cyberlium teaches bounded traces on $RE_LAB toys — NOT strace on employer databases, NOT full instruction traces on commercial binaries for piracy, NOT publishing traces with secrets unredacted. Time-box traces; correlate with breakpoint hits; store chmod 600.
1. Syscall and library trace
strace./crackme captures open, read, write — spot file checks and /proc reads (anti-debug literacy preview).
ltrace shows libc calls — strcmp, printf, malloc — map to pseudocode function names you assigned in Ghidra.
Command guide
Try these commands — Syscall and library trace
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
GDB stepping — https://sourceware.org/gdb/current/onlinedocs/gdb.html/Continuing-and-Stepping.html GDB examine — https://sourceware.org/gdb/current/onlinedocs/gdb.html/Memory.html GNU GDB tutorial — https://sourceware.org/gdb/current/onlinedocs/gdb.html/Tutorial.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install gdb
macOS:
Command — copy this
brew install gdb
Windows: Use WSL gdb
═══ LINUX / macOS ═══
Optional command
sudo apt install gdb # gdb
Command — copy this
export LAB_RE=${LAB_RE:-$HOME/cyberlium-lab/t23-re}
gdb -q -batch -ex 'break main' -ex 'run' -ex 'stepi' -ex 'info registers' -ex quit "$LAB_RE/bin/check" 2>/dev/null | head -20
gdb -q -batch -ex 'break add' -ex 'run' -ex 'finish' -ex quit "$LAB_RE/bin/check" 2>/dev/null | head -15Primary tools to practice this lesson: gdb. Reference sites: GDB stepping (https://sourceware.org/gdb/current/onlinedocs/gdb.html/Continuing-and-Stepping.html); GDB examine (https://sourceware.org/gdb/current/onlinedocs/gdb.html/Memory.html); GNU GDB tutorial (https://sourceware.org/gdb/current/onlinedocs/gdb.html/Tutorial.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Bounded GDB observation
Step between breakpoints only; set logging file; avoid runaway trace — cap at N instructions or one function.
Note UTC start, binary hash, and trace command in lab header — reproducibility for writeup.
3. Documentation habit
Extract ≥5 trace rows: time/category/detail — redact paths and tokens before share.
Anti-analysis recognition starts here: unexpected ptrace, timing, /proc/self/status — document, do not evade commercial DRM.
4. What you ship: trace/observe literacy card
strace/ltrace/GDB logging commands + bounded trace rule + five-row excerpt template.
5. What you record before the next lesson
Trace/observe literacy card path.
6. Wrong vs right: commercial piracy vs crackmes/CTF toys
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run strace on production payment service without authorization.
Right
Trace/observe card from $RE_LAB crackme. Next: Dynamic Lab.
Mission: trace/observe literacy card
1) Write strace and ltrace one-liners for YOUR crackme. 2) Define bounded trace rule. 3) Capture five trace rows. 4) Redaction rule for share.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “strace vs ltrace — which first on unknown crackme?”
Knowledge Check
APPLY: Trace/observe on Cyberlium uses:
Multiple choice
Knowledge Check
APPLY: True or False: Full instruction trace on licensed software for piracy is OK.
True or False
Knowledge Check
APPLY: Trace rows should include:
Multiple choice