我有以下代码:
void
attach_to_pid (int pid, char *username, int pts)
{
int sys_call_nr = 0;
struct user_regs_struct regs;
ptrace (PTRACE_ATTACH, pid, 0, 0);
waitpid (pid, 0, WCONTINUED);
ptrace (PTRACE_SETOPTIONS, pid, 0,
PTRACE_O_TRACESYSGOOD | PTRACE_O_TRACEEXIT);
while (true)
{
ptrace (PTRACE_SYSCALL, pid, 0, 0);
int status;
waitpid (pid, &status, WCONTINUED);
if (status == (SIGTRAP | PTRACE_EVENT_EXIT << 8))
break;
ptrace (PTRACE_GETREGS, pid, 0, ®s);
#ifdef __i386__
sys_call_nr = regs.eax;
#elif __x86_64__
sys_call_nr = regs.rax;
#else
#error "Unsupported architecture."
#endif
if (sys_call_nr == __NR_write)
{
printf ("read!");
}
ptrace (PTRACE_SYSCALL, pid, 0, 0);
waitpid (pid, &status, WCONTINUED);
ptrace(PTRACE_GETREGS,pid,0,®s);
printf("%d = %d\n",sys_call_nr,regs.eax);
//ptrace(PTRACE_CONT, pid, 0 , 0);
}
ptrace (PTRACE_DETACH, pid, 0, 0);
}
我得到了奇怪的结果,如下所示:
-514 = -38
-514 = -38
1 = -38
0 = -38
...
通常,当使用strace
sshd 会话进行跟踪时,我总是在写入 shell 时获得对 read 和 write 系统调用的调用。但是有了那个函数,我没有得到那个(我猜是假的)系统调用,只有(如你所见):1、0,等等......
有谁能够帮我?谢谢。