Hi,

I am trying to ptrace a process and when the system call is 'cd' change directory,
the ptrace process is able to trap it by comparing it against "__NR__open" system call. When I try to read the name of the directory from ebx register using peek_data I am getting ".message" and not the directory name.
The same thing works fine when I am tracing a file open system call.

Can someone help me on this. Thank you!

This is the LinuxQuestions unanswered questions cleanup event. We try to get to even the hardest questions eventually.

I presume you mean the chdir(2) system call. Let me know if something else is going on.

Anyway, you may have the wrong register in mind. The "trampoline" code for system calls is somewhat complicated and variable.
I suggest you just try to see what *each* of the registers points to and see if one of them *does* point to the directory name.

It is even conceivable (though unlikely) that the system call picks something up from the stack, though I would expect the trampoline to do this. I'm not familiar enough with ptrace to know for sure where in the process ptrace is actually peeking.

Good luck.