Process Tracing Using Ptrace

"LinuxGazette...makingLinuxjustalittlemorefun!"

ProcessTracingUsingPtrace

BySandeepS

1.Introduction

2.MoreDetails

#include<sys/ptrace.h>
longintptrace(enum__ptrace_requestrequest,pid_tpid,
void*addr,void*data)

2.1Howdoesptrace()work.

PTRACE_TRACEME:

PTRACE_ATTACH:

PTRACE_DETACH:

PTRACE_PEEKTEXT,PTRACE_PEEKDATA,PTRACE_PEEKUSER:

PTRACE_POKETEXT,PTRACE_POKEDATA,PTRACE_POKEUSER:

task_struct

PTRACE_SYSCALL,PTRACE_CONT:

PTRACE_SINGLESTEP;

PTRACE_KILL:

2.2Moremachine-dependentcalls

PTRACE_GETREGS,PTRACE_GETFPREGS,PTRACE_GETFPXREGS:

PTRACE_SETREGS,PTRACE_SETFPREGS,PTRACE_SETFPXREGS:

2.3Returnvaluesofptrace()

3.Asmallexample.

#include<stdio.h>
#include<stdlib.h>
#include<signal.h>
#include<syscall.h>
#include<sys/ptrace.h>
#include<sys/types.h>
#include<sys/wait.h>
#include<unistd.h>
#include<errno.h>

intmain(void)
{
longlongcounter=0;/*machineinstructioncounter*/
intwait_val;/*child'sreturnvalue*/
intpid;/*child'sprocessid*/

puts("Pleasewait");

switch(pid=fork()){
case-1:
perror("fork");
break;
case0:/*childprocessstarts*/
ptrace(PTRACE_TRACEME,0,0,0);
/*
*mustbecalledinordertoallowthe
*controloverthechildprocess
*/
execl("/bin/ls","ls",NULL);
/*
*executestheprogramandcauses
*thechildtostopandsendasignal
*totheparent,theparentcannow
*switchtoPTRACE_SINGLESTEP
*/
break;
/*childprocessends*/
default:/*parentprocessstarts*/
wait(&wait_val);
/*
*parentwaitsforchildtostopatnext
*instruction(execl())
*/
while(wait_val==1407){
counter++;
if(ptrace(PTRACE_SINGLESTEP,pid,0,0)!=0)
perror("ptrace");
/*
*switchtosinglesteptracingand
*releasechild
*ifunablecallerror.
*/
wait(&wait_val);
/*waitfornextinstructiontocomplete*/
}
/*
*continuetostop,waitandreleaseuntil
*thechildisfinished;wait_val!=1407
*Low=0177LandHigh=05(SIGTRAP)
*/
}
printf("Numberofmachineinstructions:%lld/n",counter);
return0;
}

ccfile.c

a.out

cd

4.Conclusion

SandeepS