ptrace源代码分析

 ptrace作为应用程序调试的基石，要想对其有深入的了解，最好的方法是分析它的源代码。选取linux2.6.8，更高版本的内容基本相同。实现ptrace系统调用功能的主要是sys_ptrace函数，当然还包括一些读写寄存器的辅助函数。该函数的基本结构比较简单：

（1）判断该进程是否被跟踪，即request==PTRACE_TRACEME，如果是，对其进行处理。

（2）根据被跟踪子进程的pid找到其task结构体 

（3）判断是否为init进程（pid==1）或者是自身进程current，init进程是计算机上电启动后执行的第一个进程，也是所有进程的父进程，它不能被跟踪。

（4）如果request==PTRACE_ATTACH，则将父进程附着在子进程上，并检查是否扶着成功。该命令实现的功能是父进程监视一个已经在运行的子进程。

（5）上述步骤完成后，就可以根据request的命令对子进程进行各种操作。

      该函数有个关键词asmlinkage是指明该函数用堆栈来传递参数。是汇编程序向相应的C语言程序传递参数的一种方式。其源代码如下：（linux/arch/i386/kernel/ptrace.c)

233 asmlinkage int sys_ptrace(long request, long pid, long addr, long data)234 {235         struct task_struct *child;236         struct user * dummy = NULL;237         int i, ret;238         unsigned long __user *datap = (unsigned long __user *)data;239 240         lock_kernel();241         ret = -EPERM;242         if (request == PTRACE_TRACEME) {243                 /* are we already being traced? */244                 if (current->ptrace & PT_PTRACED)245                         goto out;246                 ret = security_ptrace(current->parent, current);247                 if (ret)248                         goto out;249                 /* set the ptrace bit in the process flags. */250                 current->ptrace |= PT_PTRACED;251                 ret = 0;252                 goto out;253         }254         ret = -ESRCH;255         read_lock(&tasklist_lock);256         child = find_task_by_pid(pid);257         if (child)258                 get_task_struct(child);259         read_unlock(&tasklist_lock);260         if (!child)261                 goto out;262 263         ret = -EPERM;264         if (pid == 1)           /* you may not mess with init */265                 goto out_tsk;266 267         if (request == PTRACE_ATTACH) {268                 ret = ptrace_attach(child);269                 goto out_tsk;270         }271 272         ret = ptrace_check_attach(child, request == PTRACE_KILL);273         if (ret < 0)274                 goto out_tsk;275 276         switch (request) {277         /* when I and D space are separate, these will need to be fixed. */278         case PTRACE_PEEKTEXT: /* read word at location addr. */ 279         case PTRACE_PEEKDATA: {280                 unsigned long tmp;281                 int copied;282 283                 copied = access_process_vm(child, addr, &tmp, sizeof(tmp), 0);284                 ret = -EIO;285                 if (copied != sizeof(tmp))286                         break;287                 ret = put_user(tmp, datap);288                 break;289         }290 291         /* read the word at location addr in the USER area. */292         case PTRACE_PEEKUSR: {293                 unsigned long tmp;294 295                 ret = -EIO;296                 if ((addr & 3) || addr < 0 || 297                     addr > sizeof(struct user) - 3)298                         break;299 300                 tmp = 0;  /* Default return condition */301                 if(addr < FRAME_SIZE*sizeof(long))302                         tmp = getreg(child, addr);303                 if(addr >= (long) &dummy->u_debugreg[0] &&304                    addr <= (long) &dummy->u_debugreg[7]){305                         addr -= (long) &dummy->u_debugreg[0];306                         addr = addr >> 2;307                         tmp = child->thread.debugreg[addr];308                 }309                 ret = put_user(tmp, datap);310                 break;311         }312 313         /* when I and D space are separate, this will have to be fixed. */314         case PTRACE_POKETEXT: /* write the word at location addr. */315         case PTRACE_POKEDATA:316                 ret = 0;317                 if (access_process_vm(child, addr, &data, sizeof(data), 1) == sizeof(data))318                         break;319                 ret = -EIO;320                 break;321 322         case PTRACE_POKEUSR: /* write the word at location addr in the USER area */323                 ret = -EIO;324                 if ((addr & 3) || addr < 0 || 325                     addr > sizeof(struct user) - 3)326                         break;327 328                 if (addr < FRAME_SIZE*sizeof(long)) {329                         ret = putreg(child, addr, data);330                         break;331                 }332                 /* We need to be very careful here.  We implicitly333                    want to modify a portion of the task_struct, and we334                    have to be selective about what portions we allow someone335                    to modify. */336 337                   ret = -EIO;338                   if(addr >= (long) &dummy->u_debugreg[0] &&339                      addr <= (long) &dummy->u_debugreg[7]){340 341                           if(addr == (long) &dummy->u_debugreg[4]) break;342                           if(addr == (long) &dummy->u_debugreg[5]) break;343                           if(addr < (long) &dummy->u_debugreg[4] &&344                              ((unsigned long) data) >= TASK_SIZE-3) break;345                           346                           if(addr == (long) &dummy->u_debugreg[7]) {347                                   data &= ~DR_CONTROL_RESERVED;348                                   for(i=0; i<4; i++)349                                           if ((0x5f54 >> ((data >> (16 + 4*i)) & 0xf)) & 1)350                                                   goto out_tsk;351                           }352 353                           addr -= (long) &dummy->u_debugreg;354                           addr = addr >> 2;355                           child->thread.debugreg[addr] = data;356                           ret = 0;357                   }358                   break;359 360         case PTRACE_SYSCALL: /* continue and stop at next (return from) syscall */361         case PTRACE_CONT: { /* restart after signal. */362                 long tmp;363 364                 ret = -EIO;365                 if ((unsigned long) data > _NSIG)366                         break;367                 if (request == PTRACE_SYSCALL) {368                         set_tsk_thread_flag(child, TIF_SYSCALL_TRACE);369                 }370                 else {371                         clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);372                 }373                 child->exit_code = data;374         /* make sure the single step bit is not set. */375                 tmp = get_stack_long(child, EFL_OFFSET) & ~TRAP_FLAG;376                 put_stack_long(child, EFL_OFFSET,tmp);377                 wake_up_process(child);378                 ret = 0;379                 break;380         }381 382 /*383  * make the child exit.  Best I can do is send it a sigkill. 384  * perhaps it should be put in the status that it wants to 385  * exit.386  */387         case PTRACE_KILL: {388                 long tmp;389 390                 ret = 0;391                 if (child->state == TASK_ZOMBIE)        /* already dead */392                         break;393                 child->exit_code = SIGKILL;394                 /* make sure the single step bit is not set. */395                 tmp = get_stack_long(child, EFL_OFFSET) & ~TRAP_FLAG;396                 put_stack_long(child, EFL_OFFSET, tmp);397                 wake_up_process(child);398                 break;399         }400 401         case PTRACE_SINGLESTEP: {  /* set the trap flag. */402                 long tmp;403 404                 ret = -EIO;405                 if ((unsigned long) data > _NSIG)406                         break;407                 clear_tsk_thread_flag(child, TIF_SYSCALL_TRACE);408                 if ((child->ptrace & PT_DTRACE) == 0) {409                         /* Spurious delayed TF traps may occur */410                         child->ptrace |= PT_DTRACE;411                 }412                 tmp = get_stack_long(child, EFL_OFFSET) | TRAP_FLAG;413                 put_stack_long(child, EFL_OFFSET, tmp);414                 child->exit_code = data;415                 /* give it a chance to run. */416                 wake_up_process(child);417                 ret = 0;418                 break;419         }420 421         case PTRACE_DETACH:422                 /* detach a process that was attached. */423                 ret = ptrace_detach(child, data);424                 break;425 426         case PTRACE_GETREGS: { /* Get all gp regs from the child. */427                 if (!access_ok(VERIFY_WRITE, datap, FRAME_SIZE*sizeof(long))) {428                         ret = -EIO;429                         break;430                 }431                 for ( i = 0; i < FRAME_SIZE*sizeof(long); i += sizeof(long) ) {432                         __put_user(getreg(child, i), datap);433                         datap++;434                 }435                 ret = 0;436                 break;437         }438 439         case PTRACE_SETREGS: { /* Set all gp regs in the child. */440                 unsigned long tmp;441                 if (!access_ok(VERIFY_READ, datap, FRAME_SIZE*sizeof(long))) {442                         ret = -EIO;443                         break;444                 }445                 for ( i = 0; i < FRAME_SIZE*sizeof(long); i += sizeof(long) ) {446                         __get_user(tmp, datap);447                         putreg(child, i, tmp);448                         datap++;449                 }450                 ret = 0;451                 break;452         }453 454         case PTRACE_GETFPREGS: { /* Get the child FPU state. */455                 if (!access_ok(VERIFY_WRITE, datap,456                                sizeof(struct user_i387_struct))) {457                         ret = -EIO;458                         break;459                 }460                 ret = 0;461                 if (!child->used_math)462                         init_fpu(child);463                 get_fpregs((struct user_i387_struct __user *)data, child);464                 break;465         }466 467         case PTRACE_SETFPREGS: { /* Set the child FPU state. */468                 if (!access_ok(VERIFY_READ, datap,469                                sizeof(struct user_i387_struct))) {470                         ret = -EIO;471                         break;472                 }473                 child->used_math = 1;474                 set_fpregs(child, (struct user_i387_struct __user *)data);475                 ret = 0;476                 break;477         }478 479         case PTRACE_GETFPXREGS: { /* Get the child extended FPU state. */480                 if (!access_ok(VERIFY_WRITE, datap,481                                sizeof(struct user_fxsr_struct))) {482                         ret = -EIO;483                         break;484                 }485                 if (!child->used_math)486                         init_fpu(child);487                 ret = get_fpxregs((struct user_fxsr_struct __user *)data, child);488                 break;489         }490 491         case PTRACE_SETFPXREGS: { /* Set the child extended FPU state. */492                 if (!access_ok(VERIFY_READ, datap,493                                sizeof(struct user_fxsr_struct))) {494                         ret = -EIO;495                         break;496                 }497                 child->used_math = 1;498                 ret = set_fpxregs(child, (struct user_fxsr_struct __user *)data);499                 break;500         }501 502         case PTRACE_GET_THREAD_AREA:503                 ret = ptrace_get_thread_area(child, addr,504                                         (struct user_desc __user *) data);505                 break;506 507         case PTRACE_SET_THREAD_AREA:508                 ret = ptrace_set_thread_area(child, addr,509                                         (struct user_desc __user *) data);510                 break;511 512         default:513                 ret = ptrace_request(child, request, addr, data);514                 break;515         }516 out_tsk:517         put_task_struct(child);518 out:519         unlock_kernel();520         return ret;521 }

主要分析一下PEEKUSER命令实现的部分：其他的requset命令实现类似。

292         case PTRACE_PEEKUSR: {293                 unsigned long tmp;294 295                 ret = -EIO;296                 if ((addr & 3) || addr < 0 || 297                     addr > sizeof(struct user) - 3)298                         break;299 300                 tmp = 0;  /* Default return condition */301                 if(addr < FRAME_SIZE*sizeof(long))302                         tmp = getreg(child, addr);303                 if(addr >= (long) &dummy->u_debugreg[0] &&304                    addr <= (long) &dummy->u_debugreg[7]){305                         addr -= (long) &dummy->u_debugreg[0];306                         addr = addr >> 2;307                         tmp = child->thread.debugreg[addr];308                 }309                 ret = put_user(tmp, datap);310                 break;311         }

        PEEKUSER实现的功能是读取用户user的寄存器值包括调试寄存器的值。第296行判断地址是否对齐，越界，合法。第301行宏定义FRAME_SIZE=17，是通用寄存器的个数。它们分别是EBX、ECX、EDX、ESI、EDI、EBP、EAX、DS，  ES、FS、GS、ORIG_EAX、EIP、CS、EFLAGS、ESP、SS。用getreg来读取这些寄存器的值.getreg函数原型如下：

114 static unsigned long getreg(struct task_struct *child,115         unsigned long regno)116 {117         unsigned long retval = ~0UL;118 119         switch (regno >> 2) {120                 case FS:121                         retval = child->thread.fs;122                         break;123                 case GS:124                         retval = child->thread.gs;125                         break;126                 case DS:127                 case ES:128                 case SS:129                 case CS:130                         retval = 0xffff;131                         /* fall through */132                 default:133                         if (regno > GS*4)134                                 regno -= 2*4;135                         regno = regno - sizeof(struct pt_regs);136                         retval &= get_stack_long(child, regno);137         }138         return retval;139 }140 

函数中的形参regno表示寄存器的编号,在该文件中

linux/include/asm-i386/ptrace.h定义

 4 #define EBX 0  5 #define ECX 1  6 #define EDX 2  7 #define ESI 3  8 #define EDI 4  9 #define EBP 5 10 #define EAX 6 11 #define DS 7 12 #define ES 8 13 #define FS 9 14 #define GS 10 15 #define ORIG_EAX 11 16 #define EIP 12 17 #define CS  13 18 #define EFL 14 19 #define UESP 15 20 #define SS   16 21 #define FRAME_SIZE 17

     进程结构体TSS中存有所有寄存器的值，但在子进程被调试时处于核心态，不能够直接读取寄存器的值，所以getreg只能读取用户堆栈中的寄存器的值。不过fs，gs寄存器的值需要从TSS中读取。ds,ss,cs es均为16位，故高16位值不管。

     第136行即利用get_stack_long函数从堆栈中读出其他寄存器的值。该函数定义如下：

51 static inline int get_stack_long(struct task_struct *task, int offset) 52 { 53         unsigned char *stack; 54  55         stack = (unsigned char *)task->thread.esp0; 56         stack += offset; 57         return (*((int *)stack)); 58 }

      esp0是堆栈指针，通用的寄存器在堆栈中按顺序排放，通过偏移量0ffset便可以依次读取。第303行到308行是读取调试寄存器的值。

      因此，总的来说，ptrace系统调用最主要的是核心函数是sys_ptarce函数，并在该函数中调用了寄存器的辅助读写函数，内存辅助读写函数，通过传入各种request命令，实现了强大的调试功能。