3 ms·
Good brief intro article. At some point I tried to get deeper and understand ptrace(2) syscall, the technology behind strace command line tool. I wrote this pi
by majke 10y ago
Good brief intro article.
At some point I tried to get deeper and understand ptrace(2) syscall, the technology behind strace command line tool. I wrote this piece:
https://idea.popcount.org/2012-12-11-linux-process-states/ https://idea.popcount.org/2012-12-11-linux-process-states/
The ptrace() articles were never finished, but oh well. I guess ptrace() is doomed to be undocumented and barely understood. Recently I found this gem in 1983 4.2BSD operating system man page :
> Ptrace is unique and arcane; it should be replaced with a special file which can be opened and read and written. The control functions could then be implemented with ioctl(2) calls on this file. This would be simpler to understand and have much higher performance.
http://www.tuhs.org/cgi-bin/utree.pl?file=4.2BSD/usr/man/man2/ptrace.2 http://www.tuhs.org/cgi-bin/utree.pl?file=4.2BSD/usr/man/man...
- pm215 10y agoptrace() isn't undocumented, it has a fairly long manpage: http://man7.org/linux/man-pages/man2/ptrace.2.html http://man7.org/linux/man-pages/man2/ptrace.2.html It's certainly pretty hairy, but on the other hand only a handful of programs (debuggers, strace, similar debug type tools) are ever going to need to use it.
- tcoppi 10y agoPretty hairy is an understatement. There are so many edge cases with ptrace based on how it works(interactions with signals especially) that make it almost impossible to make a truly robust debugger with it. Solaris did it right with their procfs debugger interface. I really wish Linux would step up the game here.
- jdamato 10y agoI wrote an article explaining how ptrace works, which may interest you: https://blog.packagecloud.io/eng/2016/02/29/how-does-strace-work/ https://blog.packagecloud.io/eng/2016/02/29/how-does-strace-...