I'm trying out ptrace system calls, I just discovered Cross Memory Attach from Christopher Yeoh.

I wonder which one is better in term of performance between Cross Memory Attach and ptrace.

Thanks in advance

  • 1
    use both -- they're not equivalent. use ptrace() to control the process and process_vm_*() instead of PTRACE_PEEK or POKE. – mosvy Feb 25 at 10:01
  • 1
    you can also use /proc/PID/mem, but since there's no multi-pread() or multi-pwrite(), the process_vm_*() funcs are nicer, even if the rationale for their existence is not convincing ;-) – mosvy Feb 25 at 10:09
  • Thank you very much @mosvy, why process_vm_*() is nicer for read & write than ptrace with PEEK and POKE please ? :) – Pierre Le Guen Feb 25 at 10:17
  • 1
    I was saying that process_vm_*() are nicer than pread, pwrite, readv, etc on /proc/pid/mem. Their advantage vs ptrace_peekdata or pokedata is obvious -- the latter can only transfer one word at a time. I suggest you try them insyead of doing a dry assessment. – mosvy Feb 25 at 10:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.