Back story: While running a program under strace I notice that \'/dev/urandom\' is being open\'ed. I would like to know where this call is coming
strace
open
Like Andre Puel said:
break open if strcmp($rdi,"/dev/urandom") == 0
Might do the job.