Tracee runs on Android

[skandbug]

Tracee is a great tool.
But can it run on Android platform? Works like strace under Android.

[yanivagman]

I tested Tracee on Android a few months ago, and it worked.
It may be that with recent changes, it is now broken since we don't test it regularly on Android.
I also have a side project implemented two years ago that used an old version of Tracee with specific additions to Android (e.g. tracing Android native library functinos and API functions as well). It can be found here: https://github.com/yanivagman/BPFroid

[skandbug]

Thank you, I am studying hard. I will come back to you if I don't understand anything.

[skandbug]

Please advise:
If I deploy your Tracee in an Android system or emulator that is available now, how do I need to start?

[yanivagman]

If you are deploying to an emulator, you will probably need to compile for x86 architecture. For an Android device, the more probable architecture is ARM64 (instructions for how to cross-compile a binary for ARM64 are in the BPFroid repo link provided above). So first start by understanding the target architecture.
Then, depends on your target kernel it may support CO-RE or not. If it does, then you are all set and should be able to run Tracee on the target device by building a STATICALY linked binary. More information about this can be found here: https://aquasecurity.github.io/tracee/v0.13/contributing/building/building/

If your target kernel doesn't have CO-RE support you will need to build the non-CO-RE binary. See more about building a non-core binary here: https://aquasecurity.github.io/tracee/v0.13/contributing/building/nocore-ebpf/
Be aware, however, that starting from the next version of Tracee we are going to drop non-CORE support, in which case you will need to provide a BTF file to run Tracee.

[skandbug]

Thanks, I'll try the method you gave me.

[skandbug]

Under Android, you mentioned using bpfroid and I ran into some problems.

yanivagman/BPFroid#10

Can you tell me how to do it?
Thank you