Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- #include <stdio.h>
- #include <sys/ptrace.h>
- #include <stdlib.h>
- #include <sys/user.h>
- #include <sys/types.h>
- #include <sys/types.h>
- #include <sys/wait.h>
- int main(int argc, char **argv)
- {
- pid_t traced_process = atoi(argv[1]);
- struct user_regs_struct regs;
- long ins;
- int entered = 0;
- int status;
- pid_t retcode;
- /* attach and stop process */
- ptrace(PTRACE_ATTACH, traced_process, NULL, NULL);
- /* Restarts the stopped child, but arranges for the child
- to be stopped at the next entry call */
- ptrace(PTRACE_SYSCALL, traced_process, NULL, NULL);
- /* This process blocks until the child is stopped again */
- waitpid(traced_process, &status, __WALL);
- /* print status to standard out */
- printf("WIFSTOPPED(status) = %d\n", WIFSTOPPED(status));
- /* Copy the registers and print out regs.orig_rax */
- ptrace(PTRACE_GETREGS, traced_process, NULL, ®s);
- printf("interrupt with system call: %d\n\n", regs.orig_rax);
- printf(": %s\n\n", regs.rcx);
- /* Start the stopped child again and arrange for child
- to be stopped at the next exit */
- ptrace(PTRACE_SYSCALL, traced_process, NULL, NULL);
- /* This process blocks until the child is stopped again */
- waitpid(traced_process, &status, __WALL);
- /* print status to standard out */
- printf("WIFSTOPPED(status) = %d\n", WIFSTOPPED(status));
- /* Copy the registers and print out regs.orig_rax */
- ptrace(PTRACE_GETREGS, traced_process, NULL, ®s);
- printf("interrupt with system call: %d\n\n", regs.orig_rax);
- return 0;
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement