In the Linux world, commands can lie. A binary might tell you it's just "printing info," but deep down, it's whispering secrets to the kernel.
strace is your investigative tool. It shows you every System Call (syscall)—the "call log" between the application and the Linux Kernel.
The call log never lies.
The "I touched a file" log.
Suspicious if touching /etc/shadow or /root keys.
The "I called someone" log.
Suspicious for simple apps that shouldn't need internet.
The "I started a program" log.
Suspicious if an app starts a shell (/bin/sh) unexpectedly.
The command says: 'I just printed system info.' Verify its story.
Select any suspicious syscalls in the terminal above (click them), then make your verdict.
You've mastered the art of the "Call Log." You now understand that while an application can lie in its UI, its syscalls to the kernel never lie.
Lesson 1
Commands can lie; Output can be faked.
Lesson 2
System Calls are the ultimate truth.
Lesson 3
Strace is your first line of investigation.