ltrace

Trace library/function calls.

KaliParrotLinuxpassive

pkg: ltrace

ltrace intercepts and records dynamic library calls a program makes, complementing strace’s syscall view.

Syntax

ltrace {command}

Example

ltrace ./binary

Shows libc/library calls (e.g. strcmp, memcpy) with arguments as the program runs.

Options & flags

What each switch does. Toggle them in the builder below to assemble a command.

-fFollow child processes.
-e <malloc+free>Filter which library calls to trace.
-p <1234>Attach to a PID.
-o <trace.txt>Write output to a file.
-SAlso show syscalls.

Command builder

Tick options (and fill any values) to build a ready-to-copy command.

ltrace

Usage examples

ltrace ./binary

Trace library calls (e.g. strcmp on a password check).

ltrace -e strcmp ./binary

Only trace strcmp calls.

Advantages
  • Reveals library-level logic
  • Pairs with strace
  • Good for cracking simple checks
Disadvantages
  • Less useful on static binaries
  • Slows execution
  • Noisy output
Tags
#library-calls#dynamic

Official docs: ltrace

Related commands

Frequently asked questions

What is ltrace used for?
ltrace intercepts and records dynamic library calls a program makes, complementing strace’s syscall view.
What is an example ltrace command?
A common example is: ltrace ./binary — Shows libc/library calls (e.g. strcmp, memcpy) with arguments as the program runs.
Is ltrace part of Kali Linux?
Yes. ltrace ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install ltrace.
What category of security tool is ltrace?
ltrace is a Reverse Engineering tool with a passive-risk profile when run against a live target.

Try recon tools live

Run real scans against a domain you control, stage by stage.

Open the lab →