linux - Ptrace parent process -
i'm trying monitor/redirect syscalls in own process. ld_preload doesn't work when fwrite
calls write
inside libc, , got/plt hooks seem have same problem. i'm looking solution based on ptrace, can't fork() , run main app child because app communicates parent via signals.
there thread 2006 suggests tracer can on thread group that's different tracee, doesn't seem work in practice: http://yarchive.net/comp/linux/ptrace_self_attach.html
pid = fork(); if (pid == 0) { prctl(pr_set_ptracer, getppid()); raise(sigstop); } else { sleep(1); ptrace(ptrace_seize, pid, null, null); (;;) { int status; int ret = waitpid(pid, &status, 0); warn("wait=%d:", ret); ret = ptrace(ptrace_syscall, pid, null, null); warn("ptrace=%d:", ret); } }
the problem i'm facing ptrace(ptrace_syscall) expects tracee in ptrace-wait state, i.e. must have raised sigstop , tracer needs wait() it. since relation inversed in case (tracer child of tracee) ptrace_syscall returns esrch.
how strace away tracing existing pid ?
i'm bit unclear on you're asking here. sounds have attaching part resolved (which difficult problem resolve). if case, getting process stop not problem. send process signal. process stop , send trap can decide signal. @ point can call ptrace(ptrace_syscall, pid, 0, 0)
. both start in syscall trace mode, , prevent signal arriving @ debugee (thus not introducing unexpected signals process).
Comments
Post a Comment