This page is about how to manipulate other processes using ptrace. Some demonstration programs are supplied:
We begin by attaching to the process and waiting for a syscall.
The controlling process gets called twice per system call, so we need to determine whether we are looking at a syscall entry or exit.
Having intercepted the process on its way into a system call, we stick the filename on the stack and call open(). The parameters to the system call are in EBX, ECX and EDX. ESP is decremented so it points to the bottom of the stack (ie. at the first character of the filename).
EIP is decremented by 2 so that when the syscall is complete, the next instruction to execute is int $0x80, the syscall trap.
On syscall exit, we check the return value of the system call. error and last_error are set so they can be used to check for failed system calls.
To cleanup, we put the syscall arguments back as they were to begin with in the first syscall entry and detach from the process.
Peter Benie <firstname.lastname@example.org>