Questions tagged [ptrace]

The tag has no usage guidance, but it has a tag wiki.

Filter by
Sorted by
Tagged with
0 votes
1 answer

Why does PTRACE_PEEKUSER not allow reading of FPU registers on x86_64?

PTRACE_PEEKUSER is documented to read a word from the user area, whose partial layout on x86_64 is: struct user { struct user_regs_struct regs; int u_fpvalid; ...
TartanLlama's user avatar
0 votes
0 answers

Run GDB on background

I'm working on a program where I have 2 ncurses window, one displaying my custom shell implemented with fork+exec and on the other I want show some info about command ran on my shell. For that, I'm ...
brunos098's user avatar
0 votes
1 answer

syscall accept4() returns an invalid value

I created a program similar to "strace" which is able to log the syscalls. Also I installed a webserver and watched the syscalls from 'strace' and from my program and compared them. For each ...
user554179's user avatar
0 votes
2 answers

Permission error when attaching GDB to PID of running process

I have such a toy C++ program #include <iostream> int main() { int n{}; std::cin >> n; // waits for input std::cout << n << std::endl; } which pauses upon ...
Enlico's user avatar
  • 1,525
1 vote
0 answers

Strace displaying results in ASCII only at process ending and not runtime

I'm searching a way for strace to print the content of the write(...) syscall to ASCII and not useless bytes ! The Strace command I use : sudo strace -e write=1 -e trace=write -s9999 -p 551 2>&...
Doctor's user avatar
  • 133
-1 votes
1 answer

ptrace PTRACE_PEEKTEXT error

Why I get this error when I use ptrace PTRACE_PEEKTEXT in my C program?? the part of program that I use PTRACE_PEEKTEXT in it is: static void read_file(pid_t child, char *file) { char *child_addr; ...
Mostafa Sarmad's user avatar
1 vote
1 answer

Is there a better method than ptrace for intercepting ("catching") Linux syscalls coming from a forked process?

I would like to catch all syscalls coming from a forked process, modify them, send them to the kernel, and then pass them back to the forked process. Is this possible, and if so, how might I go about ...
Sally Beuford's user avatar
1 vote
0 answers

Ptrace: Function Not Implemented in GDB Installed on Multiarch/Qemu-User-Static Arm64v8/Alpine Docker Container

I want to debug an aarch64 ELF using GDB installed on an arm64v8/alpine docker on my x86_64 16.04 Ubuntu VirtualBox, which itself is installed on my Mac. In particular, to set up the docker I use the ...
Newbie's user avatar
  • 135
0 votes
1 answer

What can a debugger do with /proc that cannot be done with ptrace?

The Wikipedia article on ptrace says: Communications between the controller and target take place using repeated calls of ptrace, passing a small fixed-size block of memory between the two (...
Ryan1729's user avatar
  • 601
5 votes
0 answers

Change ptrace_scope temporarily for a specific user

ptrace_scope is a sysctl value (/proc/sys/kernel/yama/ptrace_scope) that prevents the use of ptrace on non-child processes when set to 1. This is generally considered good security practice. ...
Andrew Spott's user avatar
1 vote
1 answer

Do file writes as in-memory fake on Linux [duplicate]

I'd like to run a Linux process in a fake-write environment where all file writes (with the write(2) system call) are redirected to an in-memory cache, and subsequent reads (of the same region only) ...
pts's user avatar
  • 1,061
0 votes
0 answers

Which one to use Cross Memory Attach or ptrace?

I'm trying out ptrace system calls, I just discovered Cross Memory Attach from Christopher Yeoh. I wonder which one is better in term of performance between Cross Memory Attach and ptrace. Thanks in ...
Pierre Le Guen's user avatar
3 votes
1 answer

Why do strace and ltrace cause EINTR to happen?

Consider this program: #include <stdio.h> #include <sys/epoll.h> int main(void) { int epfd = epoll_create1(0); struct epoll_event event; = EPOLLIN; ...
Joseph Sible-Reinstate Monica's user avatar
2 votes
1 answer

How can I make a specific process exec a given executable with ptrace()?

I am trying to force the init process of an embedded Linux system to exec() my own init program (systemd) so that I can test an external filesystem before writing it to the system's flash (and risk ...
Billy's user avatar
  • 645
1 vote
0 answers

Is there a way in which we can notify the tracer (parent process) when the tracee (child process) executes a branch instruction?

As we know, the ptrace system call is one of the most powerful system calls in unix-like systems. All debugging software use ptrace for monitoring and manipulating another process, i.e. tracee. Using ...
husin alhaj ahmade's user avatar
3 votes
1 answer

Compile ptrace() program on OSX

I have this simple C program on MacOS: #include <stdlib.h> #include <sys/wait.h> #include <stdio.h> #include <sys/ptrace.h> int main(int argc, char *argv[]) { pid_t pid = ...
Alexander Mills's user avatar