ptrace question

[Diskin, Gal]

Hi Kostik,
I'm tracing a native FreeBSD process. I tried looking at the Linux code to find a hint how to port my existing Linux code to FreeBSD. 

This is exactly what I was looking for - Thank you!

Thanks,
Gal


-----Original Message-----
From: Kostik Belousov [mailto:kostikbel at gmail.com] 
Sent: Sunday, July 26, 2009 8:50 PM
To: Diskin, Gal
Cc: freebsd-hackers at freebsd.org
Subject: Re: ptrace question

On Sun, Jul 26, 2009 at 06:11:25PM +0300, Diskin, Gal wrote:
> Hi,
> I'm using ptrace to execute one application under the control
> of another (surprisingly :P). I'm trying to find the number
> of the last system call executed in the traced process from
> the tracing process. In Linux this is done using "orig_eax"
> (or "orig_rax") but as far as I can tell it does not have a
> counterpart in FreeBSD (correct me if I'm wrong). I've looked
> at the kernel sources in hope of finding out how the conversion
> was done in the Linux emulation layer. The file linux_ptrace.c
> (http://fxr.watson.org/fxr/source/i386/linux/linux_ptrace.c?v=FREEBSD7
> 2#L118) seems to be the place the conversion is taking place. However,
> in spite the comment at the top of the conversion function mentioning
> that the translation is not straightforward, the translation done is
> simply copying eax to orig_eax.
>
> My question is: Is there a way to find the number of the last system
> call executed in the traced application from the tracing application
> (using ptrace)?

Are you trying to trace linux process, or native freebsd ?
And, is the tracer linux process, or freebsd one ?
It seems that you are talking about linux process, note that linux
PTRACE_SYSCALL is not implemented in linuxolator.

For native FreeBSD tracers, you can use PT_TO_SCE, that stops the process
at the syscall entry, PT_TO_SCX, that stops at the syscall exit.
Most likely, truss source code is most illustrative in the usage.
The flags allow to trace both freebsd and linux processes.

After the process is stopped, you should get registers of the traced
process. Upon syscall entry, %eax contains syscall number.
---------------------------------------------------------------------
Intel Israel (74) Limited

This e-mail and any attachments may contain confidential material for
the sole use of the intended recipient(s). Any review or distribution
by others is strictly prohibited. If you are not the intended
recipient, please contact the sender and delete all copies.