security enabled verified low v1.0.0

ltrace

Library call tracer for monitoring dynamic library calls made by a running program.

📋 Live Preview

ltrace -c {binary}

🌍 binary →

ltrace -c {binary}

Sandbox: execFile · Timeout: 120s

Capabilities

trace.library.call

reverse.analysis

debug.tracing

Parameters

Name	Type	Required	Default	Description	Aliases
`count`	boolean	No	-	Count library calls and print summary	`-c`
`follow`	boolean	No	-	Trace child processes (fork)	`-f`
`library`	string	No	-	Only trace calls from specific library	`-l`
`output`	string	No	-	Write trace to file instead of stderr	`-o`
`pid`	integer	No	-	Attach to a running process by PID	`-p`
`syscalls`	boolean	No	-	Show system calls in addition to library calls	`-S`
`timestamp`	boolean	No	-	Add timestamp to each trace line	`-t`
`timecalls`	boolean	No	-	Show time spent inside each call	`-T`
`filter`	string	No	-	Filter calls by name pattern	`-e`
`strsize`	integer	No	-	Max string display size	`-s`
`indent`	integer	No	-	Indent output by nesting depth	`-n`
`relative`	boolean	No	-	Show relative timestamps	`-r`
`tt`	boolean	No	-	prefix with full timestamp (usec)	`-tt`
`u`	boolean	No	-	run command as user	`-u`

Contract

Inputs

file.binary

Binary to trace library calls

system.pid

Process ID to attach to

Outputs

trace.library

Library call trace log

trace.summary

Library call summary

Side effects: process_spawn

Workflow Edges

Produces

trace.librarytrace.summary

Consumes

file.binarysystem.pid

Resource Profile

Resource	Value
CPU	low
Memory	32 MB
Network	low
Disk I/O	low

Examples

Count library calls with summary

ltrace -c /bin/ls

Trace specific library only

ltrace -l libc.so.6 /bin/ls

Attach to running process

ltrace -p 1234

Show syscalls and library calls

ltrace -S /bin/ls

Trace with timestamps and call durations

ltrace -t -T /bin/ls

Write trace to file

ltrace -o trace.log /bin/ls

Documentation

ltrace — Library Call Tracer

ltrace intercepts and logs dynamic library calls made by a program. It is essential for understanding program behavior during reverse engineering, particularly for identifying library function usage patterns.

Common Use Cases

Identify which library functions a binary calls
Analyze encryption routines by tracing crypto library calls
Reverse engineer file I/O operations
Profile program execution without source code

Example Output

__libc_start_main(0x4026c0, 1, 0x7ffcdb2a6f58, 0x404540, 0x4045b0 <unfinished ...>
strlen(".")                                    = 1
malloc(3)                                      = 0x55d4c8a0c260
strcpy(0x55d4c8a0c260, ".")                    = 0x55d4c8a0c260

Related Tools

stracegdbtrace-cmd