Skip site navigation (1)Skip section navigation (2)

FreeBSD Manual Pages


home | help
PTRACE(2)		   Linux Programmer's Manual		     PTRACE(2)

       ptrace -	process	trace

       #include	<sys/ptrace.h>

       long  ptrace(enum __ptrace_request request, pid_t pid, void *addr, void

       The ptrace system call provides a means by which	a parent  process  may
       observe	and  control the execution of another process, and examine and
       change its core image and registers.  It	is primarily used to implement
       breakpoint debugging and	system call tracing.

       The  parent  can	initiate a trace by calling fork(2) and	having the re-
       sulting child do	a PTRACE_TRACEME, followed (typically) by an  exec(3).
       Alternatively, the parent may commence trace of an existing process us-
       ing PTRACE_ATTACH.

       While being traced, the child will stop each time a  signal  is	deliv-
       ered,  even if the signal is being ignored.  (The exception is SIGKILL,
       which has its usual effect.)  The parent	will be	notified at  its  next
       wait(2)	and  may  inspect  and	modify	the  child process while it is
       stopped.	 The parent then causes	the child to continue, optionally  ig-
       noring  the delivered signal (or	even delivering	a different signal in-

       When the	parent is finished tracing, it can terminate  the  child  with
       PTRACE_KILL  or	cause  it  to continue executing in a normal, untraced
       mode via	PTRACE_DETACH.

       The value of request determines the action to be	performed:

	      Indicates	that this process is to	be traced by its parent.   Any
	      signal  (except SIGKILL) delivered to this process will cause it
	      to stop and its parent to	be notified via	wait.  Also, all  sub-
	      sequent calls to exec by this process will cause a SIGTRAP to be
	      sent to it, giving the parent a chance to	 gain  control	before
	      the  new program begins execution.  A process probably shouldn't
	      make this	request	if its parent isn't  expecting	to  trace  it.
	      (pid, addr, and data are ignored.)

       The  above request is used only by the child process; the rest are used
       only by the parent.  In the following requests, pid specifies the child
       process to be acted on.	For requests other than	PTRACE_KILL, the child
       process must be stopped.

	      Reads a word at the location addr	in the child's memory, return-
	      ing  the	word as	the result of the ptrace call.	Linux does not
	      have separate text and data address spaces, so the two  requests
	      are currently equivalent.	 (The argument data is ignored.)

	      Reads  a	word  at  offset  addr in the child's USER area, which
	      holds the	registers and other information	about the process (see
	      <linux/user.h>  and  <sys/user.h>).  The word is returned	as the
	      result of	the ptrace call.  Typically the	offset must  be	 word-
	      aligned,	though	this might vary	by architecture.  (data	is ig-

	      Copies the word data to location addr in the child's memory.  As
	      above, the two requests are currently equivalent.

	      Copies  the  word	 data to offset	addr in	the child's USER area.
	      As above,	the offset must	typically be word-aligned.   In	 order
	      to  maintain  the	integrity of the kernel, some modifications to
	      the USER area are	disallowed.

	      Copies the child's general purpose or floating-point  registers,
	      respectively,   to   location   data   in	  the	parent.	   See
	      <linux/user.h> for information  on  the  format  of  this	 data.
	      (addr is ignored.)

	      Copies  the child's general purpose or floating-point registers,
	      respectively,  from  location  data  in  the  parent.   As   for
	      PTRACE_POKEUSER, some general purpose register modifications may
	      be disallowed.  (addr is ignored.)

	      Restarts the stopped child process.  If data is non-zero and not
	      SIGSTOP,	it  is	interpreted as a signal	to be delivered	to the
	      child; otherwise,	no signal is delivered.	  Thus,	 for  example,
	      the parent can control whether a signal sent to the child	is de-
	      livered or not.  (addr is	ignored.)

	      Restarts the stopped child as for	PTRACE_CONT, but arranges  for
	      the child	to be stopped at the next entry	to or exit from	a sys-
	      tem call,	or after execution of a	 single	 instruction,  respec-
	      tively.  (The child will also, as	usual, be stopped upon receipt
	      of a signal.)  From the parent's perspective, the	child will ap-
	      pear  to	have  been  stopped  by	receipt	of a SIGTRAP.  So, for
	      PTRACE_SYSCALL, for example, the idea is to  inspect  the	 argu-
	      ments  to	 the  system  call  at the first stop, then do another
	      PTRACE_SYSCALL and inspect the return value of the  system  call
	      at the second stop.  (addr is ignored.)

	      Sends  the  child	a SIGKILL to terminate it.  (addr and data are

	      Attaches to the process specified	in pid,	 making	 it  a	traced
	      "child"  of the current process; the behavior of the child is as
	      if it had	done a PTRACE_TRACEME.	The current  process  actually
	      becomes the parent of the	child process for most purposes	(e.g.,
	      it will receive notification of  child  events  and  appears  in
	      ps(1)  output  as	 the  child's parent), but a getppid(2)	by the
	      child will still return the pid of  the  original	 parent.   The
	      child  is	 sent a	SIGSTOP, but will not necessarily have stopped
	      by the completion	of this	call; use wait to wait for  the	 child
	      to stop.	(addr and data are ignored.)

	      Restarts	the  stopped  child  as	for PTRACE_CONT, but first de-
	      taches from the  process,	 undoing  the  reparenting  effect  of
	      PTRACE_ATTACH, and the effects of	PTRACE_TRACEME.	 Although per-
	      haps not intended, under Linux a traced child can	be detached in
	      this  way	 regardless of which method was	used to	initiate trac-
	      ing.  (addr is ignored.)

       Although	arguments to ptrace are	interpreted according to the prototype
       given,  GNU  libc currently declares ptrace as a	variadic function with
       only the	request	argument fixed.	 This means that unneeded trailing ar-
       guments	may  be	 omitted,  though  doing  so makes use of undocumented
       gcc(1) behavior.

       init(8),	the process with pid 1,	may not	be traced.

       The layout of the contents of memory and	the USER area  are  quite  OS-
       and architecture-specific.

       The  size of a "word" is	determined by the OS variant (e.g., for	32-bit
       Linux it's 32 bits, etc.).

       Tracing causes a	few subtle differences in the semantics	of traced pro-
       cesses.	 For  example, if a process is attached	to with	PTRACE_ATTACH,
       its original parent can no longer receive notification via wait when it
       stops,  and  there is no	way for	the new	parent to effectively simulate
       this notification.

       This page documents the way the ptrace call works currently  in	Linux.
       Its behavior differs noticeably on other	flavors	of Unix.  In any case,
       use of ptrace is	highly OS- and architecture-specific.

       The SunOS man page describes ptrace as "unique and  arcane",  which  it
       is.  The	proc-based debugging interface present in Solaris 2 implements
       a superset of ptrace functionality in a more powerful and uniform way.

       On success, PTRACE_PEEK*	requests  return  the  requested  data,	 while
       other  requests return zero.  On	error, all requests return -1, and er-
       rno(3) is set appropriately.  Since the value returned by a  successful
       PTRACE_PEEK*  request may be -1,	the caller must	check errno after such
       requests	to determine whether or	not an error occurred.

       EPERM  The specified process cannot be traced.  This could  be  because
	      the  parent has insufficient privileges; non-root	processes can-
	      not trace	processes that they cannot send	signals	 to  or	 those
	      running  setuid/setgid  programs,	for obvious reasons.  Alterna-
	      tively, the process may already be being traced, or be init (pid

       ESRCH  The  specified process does not exist, or	is not currently being
	      traced by	the caller, or is not stopped (for requests  that  re-
	      quire that).

       EIO    request is invalid, or an	attempt	was made to read from or write
	      to an invalid area in the	parent's or child's memory,  or	 there
	      was  a word-alignment violation, or an invalid signal was	speci-
	      fied during a restart request.

       EFAULT There was	an attempt to read from	or write to an invalid area in
	      the parent's or child's memory, probably because the area	wasn't
	      mapped or	accessible.   Unfortunately,  under  Linux,  different
	      variations  of this fault	will return EIO	or EFAULT more or less

       SVr4, SVID EXT, AT&T, X/OPEN, BSD 4.3

       gdb(1), strace(1), execve(2), fork(2), signal(2), wait(2), exec(3)

Linux 2.2.10			  1999-11-07			     PTRACE(2)


Want to link to this manual page? Use this URL:

home | help