Skip to content

Latest commit

 

History

History
9 lines (5 loc) · 705 Bytes

README.md

File metadata and controls

9 lines (5 loc) · 705 Bytes

ptrace example

This Linux ptrace example spawns a child process and manipulates it to run to completion. Otherwise, the child process will continue forever (until it's killed).

ptrace is used by utilites like strace as well as debuggers like gdb and lldb, which run as their own processes but spawn the target executable as a child process.

The disassemblies were generated by running objdump -d child > <arch>dump.txt on an x86-64 machine and an AArch64 machine.

Note: while macOS does defines the ptrace function, it's limited for our purposes. Other functions like task_for_pid, thread_get_state, and vm_read/vm_write are needed for this example, in addition to ptrace.