<!-- Worked example: tools/elf-trace.sh against target/sample_app. -->
# Runtime access report: sample_app

Command traced: `./sample_app`

## 1. Summary

| metric | value |
|---|---|
| processes (pid count) | 3 |
| execve'd images | 4 |
| distinct paths touched | 41 |
|   of which written/created/deleted | 5 |
|   of which read/stat only | 36 |
|   of which shared libraries | 7 |
|   of which missing (ENOENT) | 12 |
| socket operations | 5 |
| failed syscalls | 24 |


## 2. Process tree

```
- pid 618047  /work/acb/elf_analysis/target/sample_app ["./sample_app"]  [exit=0, 92 syscalls]
  - pid 618048  /work/acb/elf_analysis/target/sample_helper ["./sample_helper", "/etc/services"]  [exit=0, 201 syscalls]
  - pid 618049  /usr/bin/uname ["/usr/bin/uname", "-r"]  [exit=0, 103 syscalls]
```


### 2.1 Executed images

| pid | program | argv |
|---|---|---|
| 618047 | /work/acb/elf_analysis/target/sample_app | ["./sample_app"] |
| 618048 | /work/acb/elf_analysis/target/sample_helper | ["./sample_helper", "/etc/services"] |
| 618049 | /bin/sh | ["sh", "-c", "/usr/bin/uname -r"] |
| 618049 | /usr/bin/uname | ["/usr/bin/uname", "-r"] |


## 3. Files written, created or deleted

| path | access | syscalls | pids | errors |
|---|---|---|---|---|
| /dev/tty | write | openat(1) | 618049 | ENXIO |
| /tmp/sample_app.log | create,write,stat,seek | openat(4),fstat(2),lseek(2),write(2) | 618047 | - |
| /tmp/sample_app.sock | delete,open | unlink(2),bind(1) | 618047 | ENOENT |
| /tmp/sample_app.tmpdata | create,write,delete,read,seek | openat(2),write(1),lseek(1),read(1) | 618047 | - |
| /tmp/tmp.h3v03XcROm/trace.stdout | write,stat,ioctl | ioctl(2),fstat(1),write(1) | 618047,618049 | ENOTTY |


## 4. Files read or inspected (read-only)

| path | access | syscalls | pids | errors |
|---|---|---|---|---|
| /bin/sh | exec | execve(1) | 618049 | - |
| /dev/null | ioctl | ioctl(1) | 618049 | ENOTTY |
| /etc/hostname | open,read | openat(1),read(1) | 618047 | - |
| /etc/ld.so.cache | open,mmap,stat | openat(4),fstat(4),mmap(4) | 618047,618048,618049 | - |
| /etc/ld.so.preload | stat | access(4) | 618047,618048,618049 | ENOENT |
| /etc/os-release | open | openat(1) | 618047 | - |
| /etc/passwd | open,read,stat | read(2),openat(1),fstat(1) | 618047 | - |
| /etc/resolv.conf | open | openat(1) | 618047 | - |
| /etc/sample_app/secrets.conf | stat | newfstatat(1) | 618047 | ENOENT |
| /etc/services | open,read,stat | read(171),openat(1),fstat(1) | 618048 | - |
| /lib64/libc.so.6 | open | openat(4) | 618047,618048,618049 | - |
| /lib64/libtinfo.so.6 | open | openat(1) | 618049 | - |
| /root/.local/bin/sh | stat | newfstatat(4) | 618049 | ENOENT |
| /root/.vscode-server/cli/servers/Stable-a44adf7f53e00964ab890f9f8758a334f1fc15bc/server/bin/remote-cli/sh | stat | newfstatat(1) | 618049 | ENOENT |
| /root/bin/sh | stat | newfstatat(1) | 618049 | ENOENT |
| /usr/bin/sh | stat | newfstatat(6),access(4) | 618049 | - |
| /usr/bin/uname | exec | execve(1) | 618049 | - |
| /usr/condabin/sh | stat | newfstatat(1) | 618049 | ENOENT |
| /usr/lib/locale/locale-archive | open,mmap,stat | openat(2),fstat(2),mmap(2) | 618049 | - |
| /usr/lib/os-release | read | read(1) | 618047 | - |
| /usr/lib64/gconv/gconv-modules.cache | open,mmap,stat | openat(1),fstat(1),mmap(1) | 618049 | - |
| /usr/lib64/libc.so.6 | read,mmap,stat | pread64(16),mmap(16),read(4),fstat(4) | 618047,618048,618049 | - |
| /usr/lib64/libtinfo.so.6.2 | read,mmap,stat | mmap(4),read(1),fstat(1) | 618049 | - |
| /usr/local/bin/sh | stat | newfstatat(1) | 618049 | ENOENT |
| /usr/local/sbin/sh | stat | newfstatat(1) | 618049 | ENOENT |
| /usr/sbin/sh | stat | newfstatat(1) | 618049 | ENOENT |
| /usr/share/Modules/bin/sh | stat | newfstatat(1) | 618049 | ENOENT |
| /work | stat | newfstatat(1) | 618049 | - |
| /work/acb | stat | newfstatat(1) | 618049 | - |
| /work/acb/elf_analysis | stat | newfstatat(2) | 618049 | - |
| /work/acb/elf_analysis/target | stat | newfstatat(4) | 618049 | - |
| /work/acb/elf_analysis/target/libsampleplugin.so | open,read,mmap,stat | mmap(4),openat(1),read(1),fstat(1) | 618047 | - |
| /work/acb/elf_analysis/target/sample_app | exec | execve(1) | 618047 | - |
| /work/acb/elf_analysis/target/sample_app.conf | open,read,stat | read(2),openat(1),fstat(1) | 618047 | - |
| /work/acb/elf_analysis/target/sample_helper | exec | execve(1) | 618048 | - |
| /work/acb/semgrep-offline/.venv/bin/sh | stat | newfstatat(1) | 618049 | ENOENT |


## 5. Paths probed but absent (ENOENT)

These reveal expected config/plugin locations - often the most telling part.


| path | syscalls |
|---|---|
| /etc/ld.so.preload | access |
| /etc/sample_app/secrets.conf | newfstatat |
| /root/.local/bin/sh | newfstatat |
| /root/.vscode-server/cli/servers/Stable-a44adf7f53e00964ab890f9f8758a334f1fc15bc/server/bin/remote-cli/sh | newfstatat |
| /root/bin/sh | newfstatat |
| /tmp/sample_app.sock | unlink,bind |
| /usr/condabin/sh | newfstatat |
| /usr/local/bin/sh | newfstatat |
| /usr/local/sbin/sh | newfstatat |
| /usr/sbin/sh | newfstatat |
| /usr/share/Modules/bin/sh | newfstatat |
| /work/acb/semgrep-offline/.venv/bin/sh | newfstatat |


## 6. Shared objects actually loaded at runtime

Compare with `ldd`: anything here that ldd did not list was `dlopen`ed.


| library | access |
|---|---|
| /etc/ld.so.cache | open,mmap,stat |
| /etc/ld.so.preload | stat |
| /lib64/libc.so.6 | open |
| /lib64/libtinfo.so.6 | open |
| /usr/lib64/libc.so.6 | read,mmap,stat |
| /usr/lib64/libtinfo.so.6.2 | read,mmap,stat |
| /work/acb/elf_analysis/target/libsampleplugin.so | open,read,mmap,stat |


## 7. Directory footprint

| directory | paths touched |
|---|---|
| /etc | 8 |
| /tmp | 4 |
| /work/acb/elf_analysis/target | 4 |
| /root | 3 |
| /usr/lib64 | 3 |
| /dev | 2 |
| /lib64 | 2 |
| /usr/bin | 2 |
| /usr/lib | 2 |
| /bin | 1 |
| /usr/condabin | 1 |
| /usr/local/bin | 1 |
| /usr/local/sbin | 1 |
| /usr/sbin | 1 |
| /usr/share | 1 |
| / | 1 |
| /work | 1 |
| /work/acb | 1 |
| /work/acb/elf_analysis | 1 |
| /work/acb/semgrep-offline/.venv/bin | 1 |


## 8. Socket / network activity

| pid | call | detail | result |
|---|---|---|---|
| 618047 | socket | AF_UNIX, SOCK_STREAM | 3 |
| 618047 | bind | {sa_family=AF_UNIX, sun_path="/tmp/sample_app.sock"}, 110 | 0 |
| 618047 | listen | 1 | 0 |
| 618047 | socket | AF_INET, SOCK_STREAM | 3 |
| 618047 | connect | {sa_family=AF_INET, sin_port=htons(9), sin_addr=inet_addr("127.0.0.1")}, 16 | ECONNREFUSED |


## 9. Failed syscalls by errno

| errno | count |
|---|---|
| ENOENT | 18 |
| ENOTTY | 3 |
| ENXIO | 1 |
| EBADF | 1 |
| ECONNREFUSED | 1 |


## 10. Syscall profile per process

| pid | image | top syscalls |
|---|---|---|
| 618047 | /work/acb/elf_analysis/target/sample_app | close=17, mmap=13, openat=11, read=11, fstat=9, pread64=4, write=4, lseek=3 |
| 618048 | /work/acb/elf_analysis/target/sample_helper | read=172, mmap=8, close=5, fstat=4, pread64=4, openat=3, dup2=1, execve=1 |
| 618049 | /usr/bin/uname | newfstatat=26, mmap=23, close=10, openat=9, fstat=9, pread64=8, access=6, ioctl=4 |