Programming

Hi,All,
I use ptrace to capture the OPEN syscall, and find problems on getting filename as its argument. Basically, what ebx returns is a pointer to the filename of file to open. My code is as follows, and the program keep throwing segment fault. Besides, even if I can get filePath[0], how can I know the length of the string(or the char*), so I can get all related chars? Thanks in advance for any ideas.
Richard

//after capturing OPEN syscall
long ebx = ptrace(PTRACE_PEEKUSER, traced_process, 4 * EBX, NULL);
char * filePath = (char *) ebx;
//this line throws segment fault
cout << " filename to open is " << filePath[0];
...

Pointers from another process aren't valid inside your own. You need to read data beginning at its location with PTRACE_PEEKDATA. C-strings are always null terminated, so finding where it ends isn't a problem, though it'll be tricky since you only get to read long's, not bytes...

That's assuming you're getting the register you want in the first place. What value is EBX defined as, and why are you multiplying it by four?

thanks for the advices. It works now... I copy the code from other places, multiplication of 4 may due to that EBX may not be accordance to byte address.