Date: Mon, 27 Jul 2009 12:44:53 +0300 From: "Diskin, Gal" <gal.diskin@intel.com> To: Kostik Belousov <kostikbel@gmail.com> Cc: "freebsd-hackers@freebsd.org" <freebsd-hackers@freebsd.org> Subject: RE: ptrace question Message-ID: <D371C87D96871F4391E9F3B7085A1A62A64691CF@hasmsx502.ger.corp.intel.com> In-Reply-To: <20090726174946.GR55190@deviant.kiev.zoral.com.ua> References: <D371C87D96871F4391E9F3B7085A1A62A6468FB2@hasmsx502.ger.corp.intel.com> <20090726174946.GR55190@deviant.kiev.zoral.com.ua>
next in thread | previous in thread | raw e-mail | index | archive | help
Hi Kostik, I'm tracing a native FreeBSD process. I tried looking at the Linux code to = find a hint how to port my existing Linux code to FreeBSD.=20 This is exactly what I was looking for - Thank you! Thanks, Gal -----Original Message----- From: Kostik Belousov [mailto:kostikbel@gmail.com]=20 Sent: Sunday, July 26, 2009 8:50 PM To: Diskin, Gal Cc: freebsd-hackers@freebsd.org Subject: Re: ptrace question On Sun, Jul 26, 2009 at 06:11:25PM +0300, Diskin, Gal wrote: > Hi, > I'm using ptrace to execute one application under the control > of another (surprisingly :P). I'm trying to find the number > of the last system call executed in the traced process from > the tracing process. In Linux this is done using "orig_eax" > (or "orig_rax") but as far as I can tell it does not have a > counterpart in FreeBSD (correct me if I'm wrong). I've looked > at the kernel sources in hope of finding out how the conversion > was done in the Linux emulation layer. The file linux_ptrace.c > (http://fxr.watson.org/fxr/source/i386/linux/linux_ptrace.c?v=3DFREEBSD7 > 2#L118) seems to be the place the conversion is taking place. However, > in spite the comment at the top of the conversion function mentioning > that the translation is not straightforward, the translation done is > simply copying eax to orig_eax. > > My question is: Is there a way to find the number of the last system > call executed in the traced application from the tracing application > (using ptrace)? Are you trying to trace linux process, or native freebsd ? And, is the tracer linux process, or freebsd one ? It seems that you are talking about linux process, note that linux PTRACE_SYSCALL is not implemented in linuxolator. For native FreeBSD tracers, you can use PT_TO_SCE, that stops the process at the syscall entry, PT_TO_SCX, that stops at the syscall exit. Most likely, truss source code is most illustrative in the usage. The flags allow to trace both freebsd and linux processes. After the process is stopped, you should get registers of the traced process. Upon syscall entry, %eax contains syscall number. --------------------------------------------------------------------- Intel Israel (74) Limited This e-mail and any attachments may contain confidential material for the sole use of the intended recipient(s). Any review or distribution by others is strictly prohibited. If you are not the intended recipient, please contact the sender and delete all copies.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?D371C87D96871F4391E9F3B7085A1A62A64691CF>