The cornerstone of Linux application debugging-ptrace

Article Source: http://blog.csdn.net/estate66/article/details/5985746

Ptrace is short for process and trace. It is a system call interface (API) provided by the operating system to application debugger such as GDB and strace ).

The specific process is as follows: the parent process first calls fork, executes the ptrace function in the child process, assigns the ptrace_traceme to the request parameter, and then executes the exec call in the child process. The control is handed over to the parent process. By using ptrace_attach, the parent process starts to track the child process. Each time the child process is tracked, a signal is sent to the parent process. The parent process can ignore most signals. The only exception is the sigkill signal. During the process of tracking sub-processes, the parent process can view and modify the kernel image and register value of the sub-process, and pause the execution of the sub-process. After the tracing is complete, you can choose whether to continue or stop the sub-process.

The ptrace function isHighly dependent on the underlying architectureTherefore, its portability is limited.

Ptrace runs in the kernel space, while GDB and strace run in the user space. Ptrace forms the basis for application debugging.

The ptrace System Call format is as follows:

# Include

Long ptrace (Enum _ ptrace_request request, pid_t PID, void * ADDR, void * data );

The request determines which task ptrace executes, And the PID indicates the sub-process to be tracked and monitored. ADDR indicates the offset of the sub-process's user space address, and data indicates some data pointers of the sub-process. The data is to be viewed by the parent process that monitors the sub-process.

The following types of request requests are generally used:

Ptrace_traceme

Ptrace_peektext, ptrace_peekdata

Ptrace_peekusr

Ptrace_poketext, ptrace_pokedata

Ptrace_pokeusr

Ptrace_getregs, ptrace_getfpregs

And so on.

In all the above requests,Only ptrace_traceme is used in sub-processes. Other parameters in the ptrace function can be ignored.. Other requests are generally used in the parent process. Other parameters in the ptrace function, such as pid_t, identify the process ID of the monitored sub-process. ADDR is the memory address of the sub-process, and data indicates the Data Pointer to be obtained.