How to read content of application(.cpp file) and how to list down the function call?

[shravan b]

Hi,
Iam working on c++ in linux system, so i need to know how to go through the content of Application placed in a directory(.cpp file) and how to list down the "function call" in a file used by the application.

[salem c]

> the content of Application placed in a directory(.cpp file)
Huh?
Applications are not cpp files.
Directories are not cpp files.

You create an application by compiling .cpp files.
g++ -o Application main.cpp foo.cpp bar.cpp other.cpp

> how to list down the "function call" in a file used by the application.
Huh?

[kbw]

If you want to see the system calls used by the application on Linux, you can use strace.
http://manpages.org/strace

If you want to see the internal functions, you might want to consider using a debugger and stepping through the code. A common free debugger is gdb. If there's not symbol table available, you'll have to guess the name, mostly.
https://users.ece.utexas.edu/~adnan/gdb-refcard.pdf

Beyond that, pretty much all modern code on Linux (Windows too) is compiled with a form of noop at the top of each function, which can be hooked to give you insight to what app is doing at runtime. That's what gdb uses internally. But that's probably beyond you if strace is new to you.

[shravan b]

@salem c:
In my words Application means .cpp files.
In simple words, i need to know 'function call' are used by the Application and list in a txt file or any..
But i am totally unaware of application because application or .cpp files are developed by may be third party or who ever it may be.

[seeplus]

i need to know 'function call' are used

Why?

[salem c]

It seems to me that the OP is engaged in some reverse engineering, because it seems that they don't have the source code and all this talk of 'cpp files' is a red herring.

I mean, if they had the source code, you could just read the code to find 'function call'.

For a start, there's no guarantee that C++ was used to write any given program, or even if C++ was the only language used.

Here's a simple program.

#include <iostream>
using namespace std;

static void foo ( ) {
  cout << "This is foo\n";
}

static void bar( ) {
  cout << "This is bar\n";
}

int main() {
  foo();
  bar();
  return 0;
}

Now you might be lucky, and be able to do this.

$ nm a.out -C | grep -v ' U '
0000000000601050 B __bss_start
0000000000601170 b completed.7594
0000000000601040 D __data_start
0000000000601040 W data_start
00000000004006b0 t deregister_tm_clones
0000000000400730 t __do_global_dtors_aux
0000000000600e08 t __do_global_dtors_aux_fini_array_entry
0000000000601048 D __dso_handle
0000000000600e18 d _DYNAMIC
0000000000601050 D _edata
0000000000601178 B _end
0000000000400884 T _fini
0000000000400750 t frame_dummy
0000000000600df8 t __frame_dummy_init_array_entry
0000000000400a78 r __FRAME_END__
0000000000601000 d _GLOBAL_OFFSET_TABLE_
00000000004007f5 t _GLOBAL__sub_I_main
                 w __gmon_start__
00000000004008b0 r __GNU_EH_FRAME_HDR
00000000004005e8 T _init
0000000000600e08 t __init_array_end
0000000000600df8 t __init_array_start
0000000000400890 R _IO_stdin_used
                 w _ITM_deregisterTMCloneTable
                 w _ITM_registerTMCloneTable
0000000000600e10 d __JCR_END__
0000000000600e10 d __JCR_LIST__
                 w _Jv_RegisterClasses
0000000000400880 T __libc_csu_fini
0000000000400810 T __libc_csu_init
00000000004007a2 T main
00000000004006f0 t register_tm_clones
0000000000400680 T _start
0000000000601050 D __TMC_END__
00000000004007b7 t __static_initialization_and_destruction_0(int, int)
000000000040078c t bar()
0000000000400776 t foo()
0000000000601060 B std::cout@@GLIBCXX_3.4
0000000000601171 b std::__ioinit

This shows you that foo() and bar() are functions.

But it tells you nothing about how one thing calls another.

You could try your luck with disassembly, but beware that the resulting files are going to be huge for any non-trivial program.

objdump -C -d ./a.out > file.txt

But if the author stripped the symbol table before giving you the program, you get nothing.

$ strip a.out
$ nm a.out -C | grep -v ' U '
nm: a.out: no symbols
$ ./a.out
This is foo
This is bar

[ne555]

¿perhaps you are interested in the call graph?
https://ftp.gnu.org/old-gnu/Manuals/gprof-2.9.1/html_mono/gprof.html#SEC12

[shravan b]

@seeplus (3113)

Because i am working on SCA AEP profile, where profile is just present between Application and OS.
Profile have set of function call list. It support to limited number of function call and for the rest of the function call, profile should block or restrict by raising exception.

[salem c]

I'm guessing this is you as well.
https://stackoverflow.com/questions/68888357/how-to-raise-exception-for-function-call
https://linux.org/threads/how-to-handle-exception-during-runtime-using-runtime-library.36307/
But at least you mentioned "SCA AEP" up front, rather than leaving us guessing for 3 days.

Perhaps you could use a chroot jail - https://en.wikipedia.org/wiki/Chroot
Or perhaps an SE-Linux context - https://en.wikipedia.org/wiki/Security-Enhanced_Linux