Seth Woolley's Man Viewer

ptrace(2) - ptrace, ptrace - process trace - man 2 ptrace

([section] manual, -k keyword, -K [section] search, -f whatis)
man plain no title

PTRACE(2)                  Linux Programmer's Manual                 PTRACE(2)

       ptrace - process trace(3x,n,3x _nc_tracebits)

       #include <sys/ptrace.h>

       long  ptrace(enum __ptrace_request request, pid_t pid, void *addr, void

       The ptrace system call provides a means by which a parent  process  may
       observe  and  control the execution of another process, and examine and
       change its core image and registers.  It is primarily used to implement
       breakpoint debugging and system call tracing.

       The  parent  can  initiate  a  trace(3x,n,3x _nc_tracebits)  by calling fork(2) and having the
       resulting  child  do  a  PTRACE_TRACEME,  followed  (typically)  by  an
       exec(3,n,1 builtins)(3).   Alternatively,  the parent may commence trace(3x,n,3x _nc_tracebits) of an existing
       process using PTRACE_ATTACH.

       While being traced, the child will stop each time(1,2,n) a  signal(2,7)  is  deliv-
       ered,  even if(3,n) the signal(2,7) is being ignored.  (The exception is SIGKILL,
       which has its usual effect.)  The parent will be notified at  its  next
       wait(2)  and  may  inspect  and  modify  the  child process while it is
       stopped.  The parent then causes  the  child  to  continue,  optionally
       ignoring  the  delivered  signal(2,7) (or even delivering a different signal(2,7)

       When the parent is finished tracing, it can terminate  the  child  with
       PTRACE_KILL  or  cause  it  to continue executing in(1,8) a normal, untraced
       mode via PTRACE_DETACH.

       The value of request determines the action to be performed:

              Indicates that this process is to be traced by its parent.   Any
              signal(2,7)  (except SIGKILL) delivered to this process will cause it
              to stop and its parent to be notified via wait.  Also, all  sub-
              sequent calls to exec(3,n,1 builtins) by this process will cause a SIGTRAP to be
              sent to it, giving the parent a chance to  gain  control  before
              the  new program begins execution.  A process probably shouldn't
              make this request if(3,n) its parent isn't  expecting  to  trace(3x,n,3x _nc_tracebits)  it.
              (pid, addr, and data are ignored.)

       The  above request is used only by the child process; the rest are used
       only by the parent.  In the following requests, pid specifies the child
       process to be acted on.  For requests other than PTRACE_KILL, the child
       process must be stopped.

              Reads a word at the location addr in(1,8) the child's memory, return-
              ing  the  word as the result of the ptrace call.  Linux does not
              have separate text and data address spaces, so the two  requests
              are currently equivalent.  (The argument data is ignored.)

              Reads  a  word  at  offset  addr in(1,8) the child's USER area, which
              holds the registers and other information about the process (see
              <linux/user.h>  and  <sys/user.h>).  The word is returned as the
              result of the ptrace call.  Typically the offset must  be  word-
              aligned,  though  this  might  vary  by  architecture.  (data is

              Copies the word data to location addr in(1,8) the child's memory.  As
              above, the two requests are currently equivalent.

              Copies  the  word  data to offset addr in(1,8) the child's USER area.
              As above, the offset must typically be word-aligned.   In  order
              to  maintain  the integrity of the kernel, some modifications to
              the USER area are disallowed.

              Copies the child's general purpose or floating-point  registers,
              respectively,   to   location   data   in(1,8)   the   parent.    See
              <linux/user.h> for information  on  the  format  of  this  data.
              (addr is ignored.)

              Copies  the child's general purpose or floating-point registers,
              respectively,  from  location  data  in(1,8)  the  parent.   As   for
              PTRACE_POKEUSER, some general purpose register modifications may
              be disallowed.  (addr is ignored.)

              Restarts the stopped child process.  If data is non-zero and not
              SIGSTOP,  it  is  interpreted as a signal(2,7) to be delivered to the
              child; otherwise, no signal(2,7) is delivered.   Thus,  for  example,
              the  parent  can  control  whether a signal(2,7) sent to the child is
              delivered or not.  (addr is ignored.)

              Restarts the stopped child as for PTRACE_CONT, but arranges  for
              the child to be stopped at the next entry to or exit(3,n,1 builtins) from a sys-
              tem call, or after execution of a  single  instruction,  respec-
              tively.  (The child will also, as usual, be stopped upon receipt
              of a signal.)  From the parent's  perspective,  the  child  will
              appear  to  have  been stopped by receipt of a SIGTRAP.  So, for
              PTRACE_SYSCALL, for example, the idea is to  inspect  the  argu-
              ments  to  the  system  call  at the first stop, then do another
              PTRACE_SYSCALL and inspect the return value of the  system  call
              at the second stop.  (addr is ignored.)

              Sends  the  child a SIGKILL to terminate it.  (addr and data are

              Attaches to the process specified in(1,8) pid,  making  it  a  traced
              "child"  of the current process; the behavior of the child is as
              if(3,n) it had done a PTRACE_TRACEME.  The current  process  actually
              becomes the parent of the child process for most purposes (e.g.,
              it will receive notification of  child  events  and  appears  in(1,8)
              ps(1)  output  as  the  child's parent), but a getppid(2) by the
              child will still return the pid of  the  original  parent.   The
              child  is  sent a SIGSTOP, but will not necessarily have stopped
              by the completion of this call; use wait to wait for  the  child
              to stop.  (addr and data are ignored.)

              Restarts  the  stopped  child  as  for  PTRACE_CONT,  but  first
              detaches from the process, undoing  the  reparenting  effect  of
              PTRACE_ATTACH, and the effects of PTRACE_TRACEME.  Although per-
              haps not intended, under Linux a traced child can be detached in(1,8)
              this  way  regardless of which method was used to initiate trac-
              ing.  (addr is ignored.)

       Although arguments to ptrace are interpreted according to the prototype
       given,  GNU  libc currently declares ptrace as a variadic function with
       only the request argument fixed.  This  means  that  unneeded  trailing
       arguments  may  be  omitted,  though doing so makes use of undocumented(2,3)
       gcc(1) behavior.

       init(8), the process with pid 1, may not be traced.

       The layout of the contents of memory and the USER area  are  quite  OS-
       and architecture-specific.

       The  size of a "word" is determined by the OS variant (e.g., for 32-bit
       Linux it's 32 bits, etc.).

       Tracing causes a few subtle differences in(1,8) the semantics of traced pro-
       cesses.   For  example, if(3,n) a process is attached to with PTRACE_ATTACH,
       its original parent can no longer receive notification via wait when it
       stops,  and  there is no way for the new parent to effectively simulate
       this notification.

       This page documents the way the ptrace call works currently  in(1,8)  Linux.
       Its behavior differs noticeably on other flavors of Unix.  In any case,
       use of ptrace is highly OS- and architecture-specific.

       The SunOS man(1,5,7) page describes ptrace as "unique and  arcane",  which  it
       is.  The proc-based debugging interface present in(1,8) Solaris 2 implements
       a superset of ptrace functionality in(1,8) a more powerful and uniform  way.

       On  success,  PTRACE_PEEK*  requests  return  the requested data, while
       other requests return zero.  On error(8,n),  all  requests  return  -1,  and
       errno(3)  is set(7,n,1 builtins) appropriately.  Since the value returned by a success-
       ful PTRACE_PEEK* request may be -1, the caller must check  errno  after
       such requests to determine whether or not an error(8,n) occurred.

       EBUSY  (i386  only)  There  was  an  error(8,n) with allocating or freeing a
              debug register.

       EFAULT There was an attempt to read(2,n,1 builtins) from or write(1,2) to an invalid area in(1,8)
              the parent's or child's memory, probably because the area wasn't
              mapped or accessible.   Unfortunately,  under  Linux,  different
              variations  of this fault will return EIO or EFAULT more or less(1,3)

       EIO    request is invalid, or an attempt was made to read(2,n,1 builtins) from or write(1,2)
              to  an  invalid area in(1,8) the parent's or child's memory, or there
              was a word-alignment violation, or an invalid signal(2,7) was  speci-
              fied during a restart request.

       EPERM  The  specified  process cannot be traced.  This could be because
              the parent has insufficient privileges (the required  capability
              is  CAP_SYS_PTRACE);  non-root  processes cannot trace(3x,n,3x _nc_tracebits) processes
              that they cannot send(2,n) signals to or those running  setuid/setgid
              programs,  for  obvious reasons.  Alternatively, the process may
              already be being traced, or be init (pid 1).

       ESRCH  The specified process does not exist, or is not currently  being
              traced  by  the  caller,  or  is  not stopped (for requests that
              require that).

       SVr4, SVID EXT, AT&T, X/OPEN, BSD 4.3

       gdb(1), strace(1), execve(2),  fork(2),  signal(2,7)(2),  wait(2),  exec(3,n,1 builtins)(3),

Linux 2.6.6                       2004-05-27                         PTRACE(2)

References for this manual (incoming links)