相关疑难解决方法(0)

为什么这个ptrace程序说syscall返回-38?

除了我正在跑步之外,它和这个一样execl("/bin/ls", "ls", NULL);.

结果显然是错误的,因为每个系统调用返回-38:

[user@ test]# ./test_trace 
syscall 59 called with rdi(0), rsi(0), rdx(0)
syscall 12 returned with -38
syscall 12 called with rdi(0), rsi(0), rdx(140737288485480)
syscall 9 returned with -38
syscall 9 called with rdi(0), rsi(4096), rdx(3)
syscall 9 returned with -38
syscall 9 called with rdi(0), rsi(4096), rdx(3)
syscall 21 returned with -38
syscall 21 called with rdi(233257948048), rsi(4), rdx(233257828696)
...
Run Code Online (Sandbox Code Playgroud)

谁知道原因?

UPDATE

现在的问题是:

execve called with rdi(4203214), rsi(140733315680464), rdx(140733315681192)
execve returned …
Run Code Online (Sandbox Code Playgroud)

c linux ptrace

5
推荐指数
1
解决办法
3807
查看次数

如何跟踪系统调用的进程?

我正在尝试编写一个跟踪系统调用的程序.我很难完成这项工作.我尝试调用fork()来创建自己的实例(代码),然后监视生成的子进程.

目标是父进程返回子进程进行的每个系统调用的索引并将其输出到屏幕.不知何故,它没有按计划运作.

这是代码:

#include <unistd.h>     /* for read(), write(), close(), fork() */
#include <fcntl.h>      /* for open() */
#include <stdio.h>
#include <sys/ptrace.h>
#include <sys/reg.h>
#include <sys/wait.h>
#include <sys/types.h>


int main(int argc, char *argv[]) {
    pid_t child;
    long orig_eax;
    child = fork();

    if (0 == child) 
    {
        ptrace(PTRACE_TRACEME, 0, NULL, NULL);
        if (argc != 3) {
           fprintf(stderr, "Usage: copy <filefrom> <fileto>\n"); 
           return 1;
        }

        int c;
        size_t file1_fd, file2_fd; 
        if ((file1_fd = open(argv[1], O_RDONLY)) < 0) {
           fprintf(stderr, "copy: can't open …
Run Code Online (Sandbox Code Playgroud)

c linux ptrace system-calls

5
推荐指数
2
解决办法
1万
查看次数

标签 统计

c ×2

linux ×2

ptrace ×2

system-calls ×1