ptrace() - Unix, Linux System Call

Unix - Home
Unix - Getting Started
Unix - File Management
Unix - Directories
Unix - File Permission
Unix - Environment
Unix - Basic Utilities
Unix - Pipes & Filters
Unix - Processes
Unix - Communication
Unix - The vi Editor
Unix - What is Shell?
Unix - Using Variables
Unix - Special Variables
Unix - Using Arrays
Unix - Basic Operators
Unix - Decision Making
Unix - Shell Loops
Unix - Loop Control
Unix - Shell Substitutions
Unix - Quoting Mechanisms
Unix - IO Redirections
Unix - Shell Functions
Unix - Manpage Help
Unix - Regular Expressions
Unix - File System Basics
Unix - User Administration
Unix - System Performance
Unix - System Logging
Unix - Signals and Traps
Unix - Useful Commands
Unix - Quick Guide
Unix - Builtin Functions
Unix - System Calls
Unix - Commands List
Unix Useful Resources
Computer Glossary
Who is Who
Copyright © 2014 by tutorialspoint
#include <sys/ptrace.h> 

long ptrace(enum __ptrace_request request, pid_t pid,  
            void *addr, void *data); 


long ptrace(enum __ptrace_request request, pid_t pid,  
            void *addr, void *data); 


The parent can initiate a trace by calling
fork(2)
and having the resulting child do a PTRACE_TRACEME,
followed (typically) by an
exec(3).
Alternatively, the parent may commence trace of an existing process using
PTRACE_ATTACH.


While being traced, the child will stop each time a signal is delivered,
even if the signal is being ignored. 
(The exception is SIGKILL, which has its usual effect.) 
The parent will be notified at its next
wait(2)
and may inspect and modify the child process while it is stopped. 
The parent then causes the child to continue,
optionally ignoring the delivered signal
(or even delivering a different signal instead).


When the parent is finished tracing, it can terminate the child with
PTRACE_KILL or cause it to continue executing in a normal, untraced mode
via PTRACE_DETACH.


The value of request determines the action to be performed:


init(8),
the process with PID 1, may not be traced.


The layout of the contents of memory and the USER area are quite OS- and
architecture-specific. The offset supplied and the data returned might
not entirely match with the definition of
struct user 

The size of a "word" is determined by the OS variant
(e.g., for 32-bit Linux it’s 32 bits, etc.).


Tracing causes a few subtle differences in the semantics of
traced processes.
For example, if a process is attached to with PTRACE_ATTACH,
its original parent can no longer receive notification via
wait() when it stops, and there is no way for the new parent to
effectively simulate this notification.


This page documents the way the
ptrace() call works currently in Linux. 
Its behavior differs noticeably on other flavors of Unix. 
In any case, use of
ptrace() is highly OS- and architecture-specific.


The SunOS man page describes
ptrace() as "unique and arcane", which it is. 
The proc-based debugging interface
present in Solaris 2 implements a superset of
ptrace() functionality in a more powerful and uniform way.

gdb (1)
gdb (1)
strace (1)
strace (1)
execve (2)
execve (2)
fork (2)
fork (2)
signal (2)
signal (2)
wait (2)
wait (2)

Advertisements


    129 Lectures 
     23 hours 

 Eduonix Learning Solutions

    5 Lectures 
     4.5 hours 

 Frahaan Hussain

    35 Lectures 
     2 hours 

 Pradeep D

    41 Lectures 
     2.5 hours 

 Musab Zayadneh

    46 Lectures 
     4 hours 

 GUHARAJANM

    6 Lectures 
     4 hours 

 Uplatz
 Print
 Add Notes
 Bookmark this page