Differences between current version and previous revision of ptrace(2).
Other diffs: Previous Major Revision, Previous Author, or view the Annotated Edit History
| Newer page: | version 5 | Last edited on Saturday, August 23, 2003 2:45:52 pm | by JohnMcPherson | |
| Older page: | version 4 | Last edited on Sunday, March 16, 2003 7:03:40 pm | by PerryLorier | Revert |
@@ -3,13 +3,12 @@
!!SYNOPSIS
__#include <sys/ptrace.h>__
- __
long int ptrace(enum __ptrace_request__
''request''__
, pid_t__
''pid''__
, void *__
''addr''__
, void *__
''data''__
)__
+ long int ptrace(enum __ptrace_request ''request'', pid_t ''pid'', void * ''addr'', void * ''data'')
!!DESCRIPTION
-The __ptrace__ system call provides a means by which a parent process may observe and control the execution of another process, and examine and change its core image and
-
+The __ptrace__ system call provides a means by which a parent process may observe and control the execution of another process, and examine and change its core image and registers. It is primarily used to implement breakpoint debugging and system call tracing.
The parent can initiate a trace by calling fork(2) and having the resulting child do a PTRACE_TRACEME, followed (typically) by an exec(2). Alternatively, the parent may commence trace of an existing process using PTRACE_ATTACH.
While being traced, the child will stop each time a signal is delivered, even if the signal is being ignored. (The exception is [SIGKILL], which has its usual effect.) The parent will be notified at its next wait(2) and may inspect and modify the child process while it is stopped. The parent then causes the child to continue, optionally ignoring the delivered signal (or even delivering a different signal instead).
@@ -50,9 +49,9 @@
init(8), the process with pid 1, may not be traced.
The layout of the contents of memory and the USER area are quite OS- and architecture-specific.
-The size of a of a "word" is determined by the OS variant (e.g., for 32-bit Linux it’
s 32 bits, etc.).
+The size of a of a "word" is determined by the OS variant (e.g., for 32-bit Linux it'
s 32 bits, etc.).
Tracing causes a few subtle differences in the semantics of traced processes. For example, if a process is attached to with PTRACE_ATTACH, its original parent can no longer receive notification via __wait__ when it stops, and there is no way for the new parent to effectively simulate this notification.
This page documents the way the __ptrace__ call works currently in Linux. Its behavior differs noticeably on other flavors of Unix. In any case, use of __ptrace__ is highly OS- and architecture-specific.
@@ -69,8 +68,8 @@
;[EIO]: ''request'' is invalid, or an attempt was made to read from or write to an invalid area in the parent's or child's memory, or there was a word-alignment violation, or an invalid signal was specified during a restart request.
;[EFAULT]: There was an attempt to read from or write to an invalid area in the parent's or child's memory, probably because the area wasn't mapped or accessible. Unfortunately, under Linux, different variations of this fault will return [EIO] or [EFAULT] more or less arbitrarily.
!!CONFORMING TO
-SVr4, SVID EXT, AT
+SVr4, SVID EXT, AT&T, X/OPEN, [BSD] 4.3
!!SEE ALSO
exec(3), wait(2), signal(2), fork(2), gdb(1), strace(1)
