Differences between version 4 and previous revision of ptrace(2).
Other diffs: Previous Major Revision, Previous Author, or view the Annotated Edit History
| Newer page: | version 4 | Last edited on Sunday, March 16, 2003 7:03:40 pm | by PerryLorier | Revert |
| Older page: | version 1 | Last edited on Tuesday, June 4, 2002 12:23:44 am | by perry | Revert |
@@ -1,298 +1,76 @@
-PTRACE
-!!!PTRACE
-NAME
-SYNOPSIS
-DESCRIPTION
-NOTES
-RETURN VALUE
-ERRORS
-CONFORMING TO
-SEE ALSO
-----
!!NAME
+ptrace - process trace
-
-ptrace - process trace
!!SYNOPSIS
+ __#include <sys/ptrace.h>__
+ __long int ptrace(enum __ptrace_request__ ''request''__, pid_t__ ''pid''__, void *__ ''addr''__, void *__ ''data''__)__
-__#include __
-
-
-__long int ptrace(enum __ptrace_request__
-''request''__, pid_t__ ''pid''__, void *__
-''addr''__, void *__ ''data''__)__
!!DESCRIPTION
+The __ptrace__ system call provides a means by which a parent process may observe and control the execution of another process, and examine and change its core image and
+registers. It is primarily used to implement breakpoint debugging and system call tracing.
+The parent can initiate a trace by calling fork(2) and having the resulting child do a PTRACE_TRACEME, followed (typically) by an exec(2). Alternatively, the parent may commence trace of an existing process using PTRACE_ATTACH.
-The __ptrace__ system call provides
a means by
which a
-process
may observe
and control
the execution of
-another
process, and examine and change its core image and
-registers. It
is primarily used
to implement breakpoint
-debugging and system call tracing
.
+While being traced, the child will stop each time
a signal is delivered, even if the signal is being ignored. (The exception is [SIGKILL],
which has its usual effect.) The
parent will be notified at its next wait(2) and
may inspect
and modify
the child
process while it
is stopped. The parent then causes the child
to continue, optionally ignoring the delivered signal (or even delivering a different signal instead)
.
+When the parent is finished tracing, it can terminate the child with PTRACE_KILL or cause it to continue executing in a normal, untraced mode via PTRACE_DETACH.
-The parent can initiate a trace by calling fork(2)
-and having
the resulting child do a PTRACE_TRACEME, followed
-(typically) by an exec(2). Alternatively, the parent
-may commence trace of an existing process using
-PTRACE_ATTACH.
+The value of ''request'' determines
the action to be performed:
+;__PTRACE_TRACEME__: Indicates that this process is to be traced by its parent. Any signal (except SIGKILL) delivered to this process will cause it to stop and its parent to be notified via __wait.__ Also, all subsequent calls to __exec__ by this process will cause a SIGTRAP to be sent to it, giving the parent a chance to gain control before the new program begins execution. A process probably shouldn't make this request if its parent isn't expecting to trace it. (''pid'', ''addr'', and ''data'' are ignored.)
-While being traced,
the child will stop each time a signal
-is delivered, even if
the signal is being ignored
. (The
-exception is SIGKILL
, which has its usual effect.) The
-parent will be notified at its next wait(2) and may
-inspect and modify
the child process while it is stopped
.
-The parent then causes
the child to continue, optionally
-ignoring the delivered signal (or even delivering a
-different signal instead)
.
+The above request is used only by
the child process;
the rest are used only by the parent
. In the following requests
, ''pid'' specifies
the child process to be acted on
. For requests other than PTRACE_KILL,
the child process must be stopped
.
+;PTRACE_PEEKTEXT, PTRACE_PEEKDATA: Reads a word at the location ''addr'' in the child's memory, returning the word as the result of the __ptrace__ call. Linux does not have separate text and data address spaces, so the two requests are currently equivalent. (''data'' is ignored.)
-When the parent is finished tracing, it can terminate the
-child with
PTRACE_KILL or cause it to continue executing in
-normal
, untraced mode via PTRACE
_DETACH
.
+;
PTRACE_PEEKUSER: Reads
a word at offset ''addr'' in the child's __USER__ area
, which holds the registers and other information about the process (see
__ptrace__ call. Typically the offset must be word-aligned, though this might vary by architecture. (''data'' is ignored
.)
+;PTRACE_POKETEXT, PTRACE_POKEDATA: Copies a word from location ''data'' in the parent's memory to location ''addr'' in the child's memory. As above, the two requests are currently equivalent.
-The value of
''request
'' determines
the action
to be
-performed:
+;PTRACE_POKEUSER: Copies a word from location
''data
'' in
the parent's memory
to offset ''addr'' in the child's __USER__ area. As above, the offset must typically
be word-aligned. In order to maintain the integrity of the kernel, some modifications to the __USER__ area are disallowed.
+;PTRACE_GETREGS, PTRACE_GETFPREGS: Copies the child's general purpose or floating-point registers, respectively, to location ''data'' in the parent. See ''addr'' is ignored.)
-PTRACE_TRACEME
+;
PTRACE_SETREGS, PTRACE_SETFPREGS: Copies the child's general purpose or floating-point registers, respectively, from location ''data'' in the parent. As for PTRACE_POKEUSER, some general purpose register modifications may be disallowed. (''addr'' is ignored.)
+;PTRACE_CONT: Restarts the stopped child process. If ''data'' is non-zero and not SIGSTOP, it is interpreted as a signal to be delivered to the child; otherwise, no signal is delivered. Thus, for example, the parent can control whether a signal sent to the child is delivered or not. (''addr'' is ignored.)
-Indicates that this process is
to be traced by its parent
.
-Any signal
(except SIGKILL) delivered to this process
will
-cause it to stop and its parent to
be notified via
-__wait
.__ Also
, all subsequent calls
to __exec__
by
-this process will cause
a SIGTRAP to be sent
to it
, giving
-parent a chance to gain control before
the new program
-begins execution
. A process probably shouldn't make this
-request if its parent isn't expecting to trace it.
-''pid'',
''addr'', and ''data'' are
-
+;PTRACE_SYSCALL, PTRACE_SINGLESTEP: Restarts the stopped child as for PTRACE_CONT, but arranges for the child
to be stopped at the next entry to or exit from a system call, or after execution of a single instruction, respectively
. (The child
will also, as usual,
be stopped upon receipt of a signal
.) From the parent's perspective
, the child will appear
to have been stopped
by receipt of
a SIGTRAP. So, for PTRACE_SYSCALL, for example, the idea is
to inspect the arguments
to the system call at the first stop
, then do another PTRACE_SYSCALL and inspect
the return value of
the system call at the second stop
. (''addr'' is
ignored.)
+;PTRACE_KILL: Sends the child a SIGKILL to terminate it. (''addr'' and ''data'' are ignored.)
-The above request is used only by the child process
; the
-rest are used only by the parent. In the following requests,
-specifies
the child process to be acted on. For
-requests other than PTRACE_KILL
, the child process must be
-
+;PTRACE_ATTACH: Attaches to
the process specified in
''pid'', making it a traced ''ps(1)'' output as
the child's parent)
, but a getpid(2) by
the child will still return the pid of the original parent. The child is sent a [SIGSTOP], but will not necessarily have
stopped by the completion of this call; use __wait__ to wait for the child to stop. (''addr'' and ''data'' are ignored
.)
+;PTRACE_DETACH: Restarts the stopped child as for PTRACE_CONT, but first detaches from the process, undoing the reparenting effect of PTRACE_ATTACH, and the effects of PTRACE_TRACEME. Although perhaps not intended, under Linux a traced child can be detached in this way regardless of which method was used to initiate tracing. (''addr'' is ignored.)
-PTRACE_PEEKTEXT, PTRACE_PEEKDATA
-
-
-Reads a word at the location ''addr'' in the child's
-memory, returning the word as the result of the
-__ptrace__ call. Linux does not have separate text and
-data address spaces, so the two requests are currently
-equivalent. (''data'' is ignored.)
-
-
-PTRACE_PEEKUSER
-
-
-Reads a word at offset ''addr'' in the child's
-__USER__ area, which holds the registers and other
-information about the process (see
-__ptrace__ call. Typically the offset must be
-word-aligned, though this might vary by architecture.
-(''data'' is ignored.)
-
-
-PTRACE_POKETEXT, PTRACE_POKEDATA
-
-
-Copies a word from location ''data'' in the parent's
-memory to location ''addr'' in the child's memory. As
-above, the two requests are currently
-equivalent.
-
-
-PTRACE_POKEUSER
-
-
-Copies a word from location ''data'' in the parent's
-memory to offset ''addr'' in the child's __USER__
-area. As above, the offset must typically be word-aligned.
-In order to maintain the integrity of the kernel, some
-modifications to the __USER__ area are
-disallowed.
-
-
-PTRACE_GETREGS, PTRACE_GETFPREGS
-
-
-Copies the child's general purpose or floating-point
-registers, respectively, to location ''data'' in the
-parent. See
-''addr'' is ignored.)
-
-
-PTRACE_SETREGS, PTRACE_SETFPREGS
-
-
-Copies the child's general purpose or floating-point
-registers, respectively, from location ''data'' in the
-parent. As for PTRACE_POKEUSER, some general purpose
-register modifications may be disallowed. (''addr'' is
-ignored.)
-
-
-PTRACE_CONT
-
-
-Restarts the stopped child process. If ''data'' is
-non-zero and not SIGSTOP, it is interpreted as a signal to
-be delivered to the child; otherwise, no signal is
-delivered. Thus, for example, the parent can control whether
-a signal sent to the child is delivered or not. (''addr''
-is ignored.)
-
-
-PTRACE_SYSCALL, PTRACE_SINGLESTEP
-
-
-Restarts the stopped child as for PTRACE_CONT, but arranges
-for the child to be stopped at the next entry to or exit
-from a system call, or after execution of a single
-instruction, respectively. (The child will also, as usual,
-be stopped upon receipt of a signal.) From the parent's
-perspective, the child will appear to have been stopped by
-receipt of a SIGTRAP. So, for PTRACE_SYSCALL, for example,
-the idea is to inspect the arguments to the system call at
-the first stop, then do another PTRACE_SYSCALL and inspect
-the return value of the system call at the second stop.
-(''addr'' is ignored.)
-
-
-PTRACE_KILL
-
-
-Sends the child a SIGKILL to terminate it. (''addr'' and
-''data'' are ignored.)
-
-
-PTRACE_ATTACH
-
-
-Attaches to the process specified in ''pid'', making it a
-traced
-''ps__(1)
-output as the child's parent), but a getpid(2) by the
-child will still return the pid of the original parent. The
-child is sent a SIGSTOP, but will not necessarily have
-stopped by the completion of this call; use __wait__ to
-wait for the child to stop. (''addr'' and ''data'' are
-ignored.)
-
-
-PTRACE_DETACH
-
-
-Restarts the stopped child as for PTRACE_CONT, but first
-detaches from the process, undoing the reparenting effect of
-PTRACE_ATTACH, and the effects of PTRACE_TRACEME. Although
-perhaps not intended, under Linux a traced child can be
-detached in this way regardless of which method was used to
-initiate tracing. (''addr'' is ignored.)
!!NOTES
+Although arguments to __ptrace__ are interpreted according to the prototype given, GNU libc currently declares __ptrace__ as a variadic function with only the ''request'' argument fixed. This means that unneeded trailing arguments may be omitted, though doing so makes use of undocumented gcc(1) behavior.
+init(8), the process with pid 1, may not be traced.
-Although arguments to __ptrace__ are interpreted
-according to
the prototype given, GNU libc currently
-declares __ptrace__ as a variadic function with only the
-''request'' argument fixed. This means that unneeded
-trailing arguments may be omitted, though doing so makes use
-undocumented __gcc(1)__ behavior
.
+The layout of
the contents
of memory and the USER area are quite OS- and architecture-specific
.
+The size of a of a "word" is determined by the OS variant (e.g., for 32-bit Linux it’s 32 bits, etc.).
-init(8),
the process with pid 1
, may not be
-traced
.
+Tracing causes a few subtle differences in
the semantics of traced processes. For example, if a
process is attached to
with PTRACE_ATTACH
, its original parent can no longer receive notification via __wait__ when it stops, and there is no way for the new parent to effectively simulate this notification
.
+This page documents the way the __ptrace__ call works currently in Linux. Its behavior differs noticeably on other flavors of Unix. In any case, use of __ptrace__ is highly OS- and architecture-specific.
-The layout of the contents of memory
and the USER area are
-quite OS- and architecture-specific
.
+The SunOS man page describes __ptrace__ as __ptrace__ functionality in a more powerful
and uniform way
.
-
-The size of a
-
-
-Tracing causes a few subtle differences in the semantics of
-traced processes. For example, if a process is attached to
-with PTRACE_ATTACH, its original parent can no longer
-receive notification via __wait__ when it stops, and
-there is no way for the new parent to effectively simulate
-this notification.
-
-
-This page documents the way the __ptrace__ call works
-currently in Linux. Its behavior differs noticeably on other
-flavors of Unix. In any case, use of __ptrace__ is highly
-OS- and architecture-specific.
-
-
-The SunOS man page describes __ptrace__ as
-__ptrace__ functionality in a more powerful and uniform
-way.
!!RETURN VALUE
+On success, PTRACE_PEEK* requests return the requested data, while other requests return zero. On error, all requests return -1, and errno(3) is set appropriately. Since
+the value returned by a successful PTRACE_PEEK* request may be -1, the caller must check ''errno'' after such requests to determine whether or not an error occurred.
-
-On success, PTRACE_PEEK* requests return the requested data,
-while other requests return zero. On error, all requests
-return -1, and errno(3) is set appropriately. Since
-the value returned by a successful PTRACE_PEEK* request may
-be -1, the caller must check ''errno'' after such
-requests to determine whether or not an error
-occurred.
!!ERRORS
+;[EPERM]: The specified process cannot be traced. This could be because the parent has insufficient privileges; non-root processes cannot trace processes that they cannot send signals to or those running setuid/setgid programs, for obvious reasons. Alternatively, the process may already be being traced, or be __init__ (pid 1).
+;[ESRCH]: The specified process does not exist, or is not currently being traced by the caller, or is not stopped (for requests that require that).
+;[EIO]: ''request'' is invalid, or an attempt was made to read from or write to an invalid area in the parent's or child's memory, or there was a word-alignment violation, or an invalid signal was specified during a restart request.
+;[EFAULT]: There was an attempt to read from or write to an invalid area in the parent's or child's memory, probably because the area wasn't mapped or accessible. Unfortunately, under Linux, different variations of this fault will return [EIO] or [EFAULT] more or less arbitrarily.
-
-__EPERM__
-
-
-The specified process cannot be traced. This could be
-because the parent has insufficient privileges; non-root
-processes cannot trace processes that they cannot send
-signals to or those running setuid/setgid programs, for
-obvious reasons. Alternatively, the process may already be
-being traced, or be __init__ (pid 1).
-
-
-__ESRCH__
-
-
-The specified process does not exist, or is not currently
-being traced by the caller, or is not stopped (for requests
-that require that).
-
-
-__EIO__
-
-
-''request'' is invalid, or an attempt was made to read
-from or write to an invalid area in the parent's or child's
-memory, or there was a word-alignment violation, or an
-invalid signal was specified during a restart
-request.
-
-
-__EFAULT__
-
-
-There was an attempt to read from or write to an invalid
-area in the parent's or child's memory, probably because the
-area wasn't mapped or accessible. Unfortunately, under
-Linux, different variations of this fault will return EIO or
-EFAULT more or less arbitrarily.
!!CONFORMING TO
+SVr4, SVID EXT, AT
-
-SVr4, SVID EXT, AT
!!SEE ALSO
-
-
-
-
-----
+exec(3), wait(2), signal(2), fork(2), gdb(1), strace(1)
