ptrace-GETREGS


 
Thread Tools Search this Thread
Top Forums Programming ptrace-GETREGS
# 1  
Old 02-20-2009
ptrace-GETREGS

hello everybody!!
I want to post a question!I am confused about the explanation of ptrace command.
long ins;
ins=ptrace(PTRACE_GETREGS,pid,NULL,&regs); with this command i am able to read, for instance, regs.eip context or get regs.eip address?
And if i write the commad ptrace(PEEKTEXT,pid,regs.eip,NULL); after it, I get the next command that the program will execute or now i get the regs.eip context?

thanx in advance!
# 2  
Old 02-20-2009
That command stores a copy of the contents of the child process registers - in the memory of the parent process.

Yes, you can see them. But - no - you cannot directly turn them into text. The reason is that most of those have addresses, not values, in them. Text is referenced by a pointer - a memory address. You have to translate the offset the pointer "looks" at (as if you were the child process) to be able to read the text.

Also you have to "know" what those registers are doing for a living - pointer to text, integer value, pointer to integer, pointer to program text, stack pointer, etc.
# 3  
Old 02-20-2009
Quote:
Originally Posted by jim mcnamara
That command stores a copy of the contents of the child process registers - in the memory of the parent process.

Yes, you can see them. But - no - you cannot directly turn them into text. The reason is that most of those have addresses, not values, in them. Text is referenced by a pointer - a memory address. You have to translate the offset the pointer "looks" at (as if you were the child process) to be able to read the text.

Also you have to "know" what those registers are doing for a living - pointer to text, integer value, pointer to integer, pointer to program text, stack pointer, etc.
First of all, I would like to thank you for the help!!!Smilie
what i want to do is: to flip a bit, at the next instruction to be executed!(

ptrace(PTRACE_GETREGS,pid, NULL, &regs);//get register contents
ins=ptrace(PTRACE_PEEKDATA,pid, regs.eip,NULL);//ins= get the next instruction!?!
bit flip ins...
ptrace(PTRACE_SETREGS,pid,NULL,&regs);

Am I right??
Login or Register to Ask a Question

Previous Thread | Next Thread

6 More Discussions You Might Find Interesting

1. Programming

ptrace-get register values

Hi,All, I use ptrace to capture the OPEN syscall, and find problems on getting filename as its argument. Basically, what ebx returns is a pointer to the filename of file to open. My code is as follows, and the program keep throwing segment fault. Besides, even if I can get filePath, how can I know... (2 Replies)
Discussion started by: tristartom
2 Replies

2. UNIX for Advanced & Expert Users

gdb and ptrace ????

Hi all What 's the relationship between gdb and ptrace, if the kernel does not support ptrace, can gdb work ? Is there some one can explain this for me (3 Replies)
Discussion started by: yanglei_fage
3 Replies

3. Solaris

System call trapping using ptrace.

Hello experts, I am trying to trap system calls using ptrace available on Salaris. How to get the system call number which I am going to trap. In Linux I have done like below: ptrace(PTRACE_PEEKUSER, pid, 4 * ORIG_EAX, NULL); where PTRACE_PEEKUSER : is the request, this specifies the... (1 Reply)
Discussion started by: Patel
1 Replies

4. Programming

regarding ptrace equivalent in solairs

hi,'m using the 5.11 kernel version on amd64 architecture, 32-bit. i need help on the following issues 1)a proper structure to represent the register structure in the architecture 2)a function which would change the register values of the child when the control is with the parent.. ptrace_setregs... (0 Replies)
Discussion started by: sayaproj
0 Replies

5. Programming

Tracing self process using ptrace()

Kindly correct me if any of the foll is wrong: I want to trace the current process from the C program itself which I think can be done using ptrace(PTRACE_ATTACH,getpid(),0,0); I would like to get control back after a segmentation fault, or arithmetric exception (i.e. all signals that end... (1 Reply)
Discussion started by: vpraveen84
1 Replies

6. Programming

[FreeBSD] ptrace( ) - Device busy

Hello, I'm trying to obtain process memory contents using ptrace( ) on FreeBSD 4.7. I know this is neither portable nor clean, yet I'd really like to get it to work... I read the manual help page and did a google search, but couldn't find anything helpful. First, the code I'm using to read an... (5 Replies)
Discussion started by: Driver
5 Replies
Login or Register to Ask a Question