mjhjmtu

I have tried to hook system calls using linux kernel module. However, when I open a pdf file using Evince, I find no open,read and write is used on this specific file, only lstat is used.

Here is the strace log of strace evince folder1/test.pdf

So I wonder what system call does evince use to open andread from file?

As pointed out by @ThomasDickey, you need to pass strace the -f option, in order to include the trace of all the threads.

(The clone() syscalls are creating new threads, not processes, but you still need -f to have strace follow threads.)

Once you're following all threads, the open becomes aparent, opening the file in read-only mode, on file descriptor 19:

open("/home/xytao/folder1/test.pdf", O_RDONLY) = 19

The contents of the file are read using a succession of pread calls into a small 256 character buffer, the first of which gets the %PDF-1.3 header:

pread(19, "%PDF-1.3rn%241263305327rn3 0 objrn<</Fil"..., 256, 0) = 256

If you go through the trace, you'll see it will then lseek to the end of the file (to determine file size), then read a couple of blocks of data from there. I assume that's information about the pages in the document.

The following preads happen at offsets in the middle of the file, but all of them seem to start with some information about "page", so I assume that's evince figuring out about the pages in the PDF document, probably using offsets it got from the end of the file.