15. Finding Reverse-Engineering Clues in Ten Minutes with strace and ltrace

Running strace and ltrace before static analysis gives you an immediate view of I/O flow and library calls. They are excellent for narrowing down key-verification routines quickly in CTF crackmes.

Core Flow

• Trace file, socket, and process calls with strace -f -o log ./bin
• Trace libc function calls such as strcmp and memcpy with ltrace -f -o log ./bin
• Inspecting a strcmp or memcmp call immediately after input lets you trace the buffers being compared

Quick Tips

• Filtering with a command such as ltrace -e strcmp+memcmp sharply reduces noise.
• Use strace -e trace=open,read,write to find hints about file-based flags or keys.

Use static analysis for depth and dynamic tracing for speed. Combining them can make reversing feel twice as fast.