ptrace
来源:互联网 发布:javascript的oop写法 编辑:程序博客网 时间:2024/05/17 10:07
1. definition
long ptrace(int request, pid_t pid, void * addr, void * data)
request , trace type;
the request determine the meaning of the other parameters and return value.
2.
possibility of request
#define PTRACE_TRACEME 0#define PTRACE_PEEKTEXT 1#define PTRACE_PEEKDATA 2#define PTRACE_PEEKUSR 3#define PTRACE_POKETEXT 4#define PTRACE_POKEDATA 5#define PTRACE_POKEUSR 6#define PTRACE_CONT 7#define PTRACE_KILL 8#define PTRACE_SINGLESTEP 9#define PTRACE_ATTACH 0x10#define PTRACE_DETACH 0x11#define PTRACE_SYSCALL 24#define PTRACE_SETOPTIONS 0x4200#define PTRACE_GETEVENTMSG 0x4201#define PTRACE_GETSIGINFO 0x4202#define PTRACE_SETSIGINFO 0x4203#define PTRACE_O_TRACESYSGOOD 0x00000001#define PTRACE_O_TRACEFORK 0x00000002#define PTRACE_O_TRACEVFORK 0x00000004#define PTRACE_O_TRACECLONE 0x00000008#define PTRACE_O_TRACEEXEC 0x00000010#define PTRACE_O_TRACEVFORKDONE 0x00000020#define PTRACE_O_TRACEEXIT 0x00000040#define PTRACE_O_MASK 0x0000007f#define PTRACE_EVENT_FORK 1#define PTRACE_EVENT_VFORK 2#define PTRACE_EVENT_CLONE 3#define PTRACE_EVENT_EXEC 4#define PTRACE_EVENT_VFORK_DONE 5#define PTRACE_EVENT_EXIT 6
PTRACE_TRACEME
Indicates that this process is to be traced by its parent. Any signal (except SIGKILL) delivered to this process will cause it to stop and its parent to be notified viawait(2). Also, all subsequent calls to execve(2) by this process will cause aSIGTRAP to be sent to it, giving the parent a chance to gain control before the newprogram begins execution. A process probably shouldn't make this request if its parent isn't expecting to trace it. (pid, addr, and data are ignored.)
struct pt_regs r;if(ptrace(PTRACE_GETREGS, pid, 0, &r)) return 0;//different architecture has different structure of "struct pt_regs".
Sets ptrace options from data in the parent. (addr is ignored.)
data is interpreted as a bit mask of options, which are speci‐
fied by the following flags:
PTRACE_O_TRACESYSGOOD (since Linux 2.4.6)
When delivering syscall traps, set bit 7 in the signal
number (i.e., deliver (SIGTRAP | 0x80) This makes it easy
for the tracer to tell the difference between normal
traps and those caused by a syscall. (PTRACE_O_TRACESYS‐
GOOD may not work on all architectures.)
PTRACE_O_TRACEFORK (since Linux 2.5.46)
Stop the child at the next fork(2) call with SIGTRAP |
PTRACE_EVENT_FORK << 8 and automatically start tracing
the newly forked process, which will start with a
SIGSTOP. The PID for the new process can be retrieved
with PTRACE_GETEVENTMSG.
PTRACE_O_TRACEVFORK (since Linux 2.5.46)
Stop the child at the next vfork(2) call with SIGTRAP |
PTRACE_EVENT_VFORK << 8 and automatically start tracing
the newly vforked process, which will start with a
SIGSTOP. The PID for the new process can be retrieved
with PTRACE_GETEVENTMSG.
PTRACE_O_TRACECLONE (since Linux 2.5.46)
Stop the child at the next clone(2) call with SIGTRAP |
PTRACE_EVENT_CLONE << 8 and automatically start tracing
the newly cloned process, which will start with a
SIGSTOP. The PID for the new process can be retrieved
with PTRACE_GETEVENTMSG. This option may not catch
clone(2) calls in all cases. If the child calls clone(2)
with the CLONE_VFORK flag, PTRACE_EVENT_VFORK will be
delivered instead if PTRACE_O_TRACEVFORK is set; other‐
wise if the child calls clone(2) with the exit signal set
to SIGCHLD, PTRACE_EVENT_FORK will be delivered if
PTRACE_O_TRACEFORK is set.
PTRACE_O_TRACEEXEC (since Linux 2.5.46)
Stop the child at the next execve(2) call with SIGTRAP |
PTRACE_EVENT_EXEC << 8.
PTRACE_O_TRACEVFORKDONE (since Linux 2.5.60)
Stop the child at the completion of the next vfork(2)
call with SIGTRAP | PTRACE_EVENT_VFORK_DONE << 8.
PTRACE_O_TRACEEXIT (since Linux 2.5.60)
Stop the child at exit with SIGTRAP |
PTRACE_EVENT_EXIT << 8. The child's exit status can be
retrieved with PTRACE_GETEVENTMSG. This stop will be
done early during process exit when registers are still
available, allowing the tracer to see where the exit
occurred, whereas the normal exit notification is done
after the process is finished exiting. Even though con‐
text is available, the tracer cannot prevent the exit
from happening at this point.
Return Value
On success, PTRACE_PEEK* requests return the requested data, while other requests return zero. On error, all requests return -1, and errno is set appropriately. Since the value returned by a successful PTRACE_PEEK* request may be -1, the caller must check errno after such requests to determine whether or not an error occurto be continued with experiments.
- Ptrace
- ptrace
- ptrace
- ptrace
- ptrace
- ptrace
- ptrace
- 转载:ptrace
- gdb ptrace
- linux ptrace
- linux ptrace
- ptrace基础
- socket/ptrace
- Ptrace 详解
- ptrace 简介
- Playing with ptrace(玩转ptrace)
- Playing with ptrace
- Process Tracing Using Ptrace
- C语言初学—函数和指针
- 这篇文章开始,主要开始研究linux内核和hadoop
- 系统架构--揭开J2EE集群的神秘面纱(一)
- 嵌入式学习的准备--硬件篇
- 新周刊:可怕的大学: 到底有多少人在校园里浪费青春
- ptrace
- Ubuntu 11.10安装VMWare Tools小结
- 全面剖析《自己动手写操作系统》第五章---makefile文件
- iis8新特性
- git撤销commit
- Oracle ADF Hierarchy Viewer控件使用简介
- IoC容器总结与简单模拟
- 进程间通过共享内存通信
- Android Handler的使用(一)