ptrace question

[Kostik Belousov]

On Sun, Jul 26, 2009 at 06:11:25PM +0300, Diskin, Gal wrote:
> Hi,
> I'm using ptrace to execute one application under the control
> of another (surprisingly :P). I'm trying to find the number
> of the last system call executed in the traced process from
> the tracing process. In Linux this is done using "orig_eax"
> (or "orig_rax") but as far as I can tell it does not have a
> counterpart in FreeBSD (correct me if I'm wrong). I've looked
> at the kernel sources in hope of finding out how the conversion
> was done in the Linux emulation layer. The file linux_ptrace.c
> (http://fxr.watson.org/fxr/source/i386/linux/linux_ptrace.c?v=FREEBSD7
> 2#L118) seems to be the place the conversion is taking place. However,
> in spite the comment at the top of the conversion function mentioning
> that the translation is not straightforward, the translation done is
> simply copying eax to orig_eax.
>
> My question is: Is there a way to find the number of the last system
> call executed in the traced application from the tracing application
> (using ptrace)?

Are you trying to trace linux process, or native freebsd ?
And, is the tracer linux process, or freebsd one ?
It seems that you are talking about linux process, note that linux
PTRACE_SYSCALL is not implemented in linuxolator.

For native FreeBSD tracers, you can use PT_TO_SCE, that stops the process
at the syscall entry, PT_TO_SCX, that stops at the syscall exit.
Most likely, truss source code is most illustrative in the usage.
The flags allow to trace both freebsd and linux processes.

After the process is stopped, you should get registers of the traced
process. Upon syscall entry, %eax contains syscall number.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 195 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-hackers/attachments/20090726/f6742e24/attachment.pgp