内容简介
#include <sys/ptrace.h> long ptrace(enum __ptrace_request request, pid_t pid, void *addr, void *data) |
描述
ptrace()%uA0系统调用提供了其中一个父进程可以观察和控制另一个进程的执行，检查和改变其核心映像和寄存器的手段。它主要用于实现断点调试和系统调用跟踪。The parent can initiate a trace by calling%uA0fork(2) and having the resulting child do a PTRACE_TRACEME, followed (typically) by an%uA0exec(3). Alternatively, the parent may commence trace of an existing process using PTRACE_ATTACH.
While being traced, the child will stop each time a signal is delivered, even if the signal is being ignored. (The exception is SIGKILL, which has its usual effect.) The parent will be notified at its next%uA0wait(2) and may inspect and modify the child process while it is stopped. The parent then causes the child to continue, optionally ignoring the delivered signal (or even delivering a different signal instead).
When the parent is finished tracing, it can terminate the child with PTRACE_KILL or cause it to continue executing in a normal, untraced mode via PTRACE_DETACH.
The value of%uA0requestꃞtermines the action to be performed:
| 标签 | 描述 | ||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| PTRACE_TRACEME | |||||||||||||||||||||||||||||||
| %uA0 | Indicates that this process is to be traced by its parent. Any signal (except SIGKILL) delivered to this process will cause it to stop and its parent to be notified via%uA0wait(). Also, all subsequent calls to%uA0exec() by this process will cause a SIGTRAP to be sent to it, giving the parent a chance to gain control before the new program begins execution. A process probably shouldn’t make this request if its parent isn’t expecting to trace it. (pid,%uA0addr, and%uA0data%uA0are ignored.) | ||||||||||||||||||||||||||||||
| The above request is used only by the child process the rest are used only by the parent. In the following requests,%uA0pid%uA0specifies the child process to be acted on. For requests other than PTRACE_KILL, the child process must be stopped. | |||||||||||||||||||||||||||||||
| PTRACE_PEEKTEXT, PTRACE_PEEKDATA | |||||||||||||||||||||||||||||||
| %uA0 | Reads a word at the location%uA0addr%uA0in the child’s memory, returning the word as the result of the%uA0ptrace() call. Linux does not have separate text and data address spaces, so the two requests are currently equivalent. (The argument%uA0data%uA0is ignored.) | ||||||||||||||||||||||||||||||
| PTRACE_PEEKUSR | |||||||||||||||||||||||||||||||
| %uA0 | Reads a word at offset%uA0addr%uA0in the child’s%uA0USER%uA0area, which holds the registers and other information about the process (see <linux/user.h> and <sys/user.h>). The word is returned as the result of the%uA0ptrace() call. Typically the offset must be word-aligned, though this might vary by architecture. See NOTES. (data%uA0is ignored.) | ||||||||||||||||||||||||||||||
| PTRACE_POKETEXT, PTRACE_POKEDATA | |||||||||||||||||||||||||||||||
| %uA0 | Copies the word%uA0data%uA0to location%uA0addr%uA0in the child’s memory. As above, the two requests are currently equivalent. | ||||||||||||||||||||||||||||||
| PTRACE_POKEUSR | |||||||||||||||||||||||||||||||
| %uA0 | Copies the word%uA0data%uA0to offset%uA0addr%uA0in the child’s%uA0USER%uA0area. As above, the offset must typically be word-aligned. In order to maintain the integrity of the kernel, some modifications to theUSER%uA0area are disallowed. | ||||||||||||||||||||||||||||||
| PTRACE_GETREGS, PTRACE_GETFPREGS | |||||||||||||||||||||||||||||||
| %uA0 | Copies the child’s general purpose or floating-point registers, respectively, to location%uA0data%uA0in the parent. See <linux/user.h> for information on the format of this data. (addr%uA0is ignored.) | ||||||||||||||||||||||||||||||
| PTRACE_GETSIGINFO (since Linux 2.3.99-pre6) | |||||||||||||||||||||||||||||||
| %uA0 | Retrieve information about the signal that caused the stop. Copies a%uA0siginfo_t%uA0structure (see%uA0sigaction(2)) from the child to location%uA0data%uA0in the parent. (addr%uA0is ignored.) | ||||||||||||||||||||||||||||||
| PTRACE_SETREGS, PTRACE_SETFPREGS | |||||||||||||||||||||||||||||||
| %uA0 | Copies the child’s general purpose or floating-point registers, respectively, from location%uA0data%uA0in the parent. As for PTRACE_POKEUSER, some general purpose register modifications may be disallowed. (addr%uA0is ignored.) | ||||||||||||||||||||||||||||||
| PTRACE_SETSIGINFO (since Linux 2.3.99-pre6) | |||||||||||||||||||||||||||||||
| %uA0 | Set signal information. Copies a%uA0siginfo_t%uA0structure from locationdata%uA0in the parent to the child. This will only affect signals that would normally be delivered to the child and were caught by the tracer. It may be difficult to tell these normal signals from synthetic signals generated by%uA0ptrace() itself. (addr%uA0is ignored.) | ||||||||||||||||||||||||||||||
| PTRACE_SETOPTIONS (since Linux 2.4.6 see BUGS for caveats) | |||||||||||||||||||||||||||||||
| %uA0 |
Sets ptrace options from%uA0data%uA0in the parent. (addr%uA0is ignored.)data%uA0is interpreted as a bitmask of options, which are specified by the following flags:
|
||||||||||||||||||||||||||||||
| PTRACE_GETEVENTMSG (since Linux 2.5.46) | |||||||||||||||||||||||||||||||
| %uA0 | Retrieve a message (as an%uA0unsigned long) about the ptrace event that just happened, placing it in the location%uA0data%uA0in the parent. For PTRACE_EVENT_EXIT this is the child’s exit status. For PTRACE_EVENT_FORK, PTRACE_EVENT_VFORK and PTRACE_EVENT_CLONE this is the PID of the new process. (addris ignored.) | ||||||||||||||||||||||||||||||
| PTRACE_CONT | |||||||||||||||||||||||||||||||
| %uA0 | Restarts the stopped child process. If%uA0data%uA0is non-zero and not SIGSTOP, it is interpreted as a signal to be delivered to the child otherwise, no signal is delivered. Thus, for example, the parent can control whether a signal sent to the child is delivered or not. (addr%uA0is ignored.) | ||||||||||||||||||||||||||||||
| PTRACE_SYSCALL, PTRACE_SINGLESTEP | |||||||||||||||||||||||||||||||
| %uA0 | Restarts the stopped child as for PTRACE_CONT, but arranges for the child to be stopped at the next entry to or exit from a system call, or after execution of a single instruction, respectively. (The child will also, as usual, be stopped upon receipt of a signal.) From the parent’s perspective, the child will appear to have been stopped by receipt of a SIGTRAP. So, for PTRACE_SYSCALL, for example, the idea is to inspect the arguments to the system call at the first stop, then do another PTRACE_SYSCALL and inspect the return value of the system call at the second stop. (addr%uA0is ignored.) | ||||||||||||||||||||||||||||||
| PTRACE_SYSEMU, PTRACE_SYSEMU_SINGLESTEP (since Linux 2.6.14) | |||||||||||||||||||||||||||||||
| %uA0 | For PTRACE_SYSEMU, continue and stop on entry to the next syscall, which will not be executed. For PTRACE_SYSEMU_SINGLESTEP, do the same but also singlestep if not a syscall. This call is used by programs like User Mode Linux that want to emulate all the the child’s syscalls. (addr%uA0anddata%uA0are ignored not supported on all architectures.) | ||||||||||||||||||||||||||||||
| PTRACE_KILL | |||||||||||||||||||||||||||||||
| %uA0 | Sends the child a SIGKILL to terminate it. (addr%uA0and%uA0data%uA0are ignored.) | ||||||||||||||||||||||||||||||
| PTRACE_ATTACH | |||||||||||||||||||||||||||||||
| %uA0 | Attaches to the process specified in%uA0pid, making it a traced "child" of the current process the behavior of the child is as if it had done a PTRACE_TRACEME. The current process actually becomes the parent of the child process for most purposes (e.g., it will receive notification of child events and appears inps(1) output as the child’s parent), but a%uA0getppid(2) by the child will still return the PID of the original parent. The child is sent a SIGSTOP, but will not necessarily have stopped by the completion of this call use%uA0wait() to wait for the child to stop. (addr%uA0and%uA0data%uA0are ignored.) | ||||||||||||||||||||||||||||||
| PTRACE_DETACH | |||||||||||||||||||||||||||||||
| %uA0 | Restarts the stopped child as for PTRACE_CONT, but first detaches from the process, undoing the reparenting effect of PTRACE_ATTACH, and the effects of PTRACE_TRACEME. Although perhaps not intended, under Linux a traced child can be detached in this way regardless of which method was used to initiate tracing. (addr%uA0is ignored.) | ||||||||||||||||||||||||||||||
注意
Although arguments to%uA0ptrace() are interpreted according to the prototype given, GNU libc currently declares%uA0ptrace() as a variadic function with only the%uA0request%uA0argument fixed. This means that unneeded trailing arguments may be omitted, though doing so makes use of undocumented%uA0gcc(1) behavior.init(8), the process with PID 1, may not be traced.
The layout of the contents of memory and the USER area are quite OS- and architecture-specific. The offset supplied and the data returned might not entirely match with the definition of%uA0struct user
The size of a "word" is determined by the OS variant (e.g., for 32-bit Linux it’s 32 bits, etc.).
Tracing causes a few subtle differences in the semantics of traced processes. For example, if a process is attached to with PTRACE_ATTACH, its original parent can no longer receive notification via%uA0wait() when it stops, and there is no way for the new parent to effectively simulate this notification.
This page documents the way the%uA0ptrace() call works currently in Linux. Its behavior differs noticeably on other flavors of Unix. In any case, use of%uA0ptrace() is highly OS- and architecture-specific.
The SunOS man page describes%uA0ptrace() as "unique and arcane", which it is. The proc-based debugging interface present in Solaris 2 implements a superset of%uA0ptrace() functionality in a more powerful and uniform way.
返回值
On success, PTRACE_PEEK* requests return the requested data, while other requests return zero. On error, all requests return -1, and%uA0errno%uA0is set appropriately. Since the value returned by a successful PTRACE_PEEK* request may be -1, the caller must checkerrnoꂯter such requests to determine whether or not an error occurred.BUGS
On hosts with 2.6 kernel headers, PTRACE_SETOPTIONS is declared with a different value than the one for 2.4. This leads to applications compiled with such headers failing when run on 2.4 kernels. This can be worked around by redefining PTRACE_SETOPTIONS to PTRACE_OLDSETOPTIONS, if that is defined.错误
| 标签 | 描述 |
|---|---|
| EBUSY | (i386 only) There was an error with allocating or freeing a debug register. |
| EFAULT | There was an attempt to read from or write to an invalid area in the parent’s or child’s memory, probably because the area wasn’t mapped or accessible. Unfortunately, under Linux, different variations of this fault will return EIO or EFAULT more or less arbitrarily. |
| EINVAL | An attempt was made to set an invalid option. |
| EIO | request%uA0is invalid, or an attempt was made to read from or write to an invalid area in the parent’s or child’s memory, or there was a word-alignment violation, or an invalid signal was specified during a restart request. |
| EPERM | The specified process cannot be traced. This could be because the parent has insufficient privileges (the required capability isCAP_SYS_PTRACE) non-root processes cannot trace processes that they cannot send signals to or those running set-user-ID/set-group-ID programs, for obvious reasons. Alternatively, the process may already be being traced, or beinit%uA0(PID 1). |
| ESRCH | The specified process does not exist, or is not currently being traced by the caller, or is not stopped (for requests that require that). |