ptrace conundrum

asif_bahrainwala · 08-19-2016, 12:10 PM

Hi,
I am using ptrace to write my own debugger,
After I call ptrace(ptrace_attach...), my tracee gets a SIGSTOP,

while handling this in my debugger,
I have to call PTRACE_SINGLESTEP ,
waitpid,
then set my breakpoints,
then call ptrace(ptrace_cont...)

This works correctly, however I want to know why was ptrace_singlestep needed

I looked at http://stackoverflow.com/questions/1...ltiple-threads
and
http://eli.thegreenplace.net/2011/01...s-work-part-1/

asif_bahrainwala · 08-19-2016, 01:43 PM

my best guess is that when the debugger gets the "wait" to return since the child has received SIGSTOP, the child may not stop immediately and is still pending to be moved to the sleep queue and may execute few instructions.
To ensure that it predictably stops at the RIP queried using ptrace, we must call ptrace(PTRACE_SINGLESTEP ....) first. This will set the Trace flag bit and cause the CPU to break (int 1). Now we can query the registers, alter the memory etc.