How to find out where all a closed source application is writing to?

Question

I have an application (the source for which I don't have), which can be invoked from command line like this

$ ./notmyapp

I want to know all the locations where the application is writing to. It outputs some files in the directory it is being called from, but I need to make sure that those are the only files that are created.

So, I need to isolate the application to find out which all files it created/edited while it was running.

How can I do this?

Some way using Perl or C or C++? Do any of the standard libraries in these languages have ways to do this?

Answer 1

you could use strace.

Answer 2

In unix systems, you can use strace to print out a trace of all the system calls made and signals received by a process:

$ strace ./notmyapp

grep can be used to limit the output to subset of system calls:

$ strace ./notmyapp 2>&1 | egrep '(open|write)'

Answer 3

You could try running it as a user which has no rights to write anywhere on any drive. Then you get an error message when it tries to create/write the first file. Log that directory/file and give write rights to it, then repeat until there are no more error messages.

Answer 4

strace, ktrace/kdump, truss, dtruss, or whatever other program your platform provides for tracing system calls is probably what you're looking for.

Expect lots of output from any of those. To figure out what files the application is reading and writing to, you might want to limit the output to just a few syscalls. strace -eopen ./notmyapp, for example.

The application might also fork off child processes to do some of its work. With most system call tracers, you'll have to be specific about tracing those child processes as well. With strace, that'd be strace -f ./notmyapp.

Answer 5

You say in response to rafl's answer that notmyapp is supposed to produce a prompt and wait for [...] inputs before doing something.

Put your inputs in advance into a plain text file (say, responses.txt), one input per line. Then use strace, as suggested to track calls to open() or write() piping in the contents of responses.txt:

$ strace -eopen -ewrite ./notmyapp < responses.txt

If you're expecting a lot of file access, then you may want to pipe the output to your favourite pager or editor:

$ strace -eopen -ewrite ./notmyapp < responses.txt | vim -R -

strace is a powerful tool. For more information, consult man strace.