Search icon
Arrow left icon
All Products
Best Sellers
New Releases
Books
Videos
Audiobooks
Learning Hub
Newsletters
Free Learning
Arrow right icon
Learning Linux Binary Analysis

You're reading from  Learning Linux Binary Analysis

Product type Book
Published in Feb 2016
Publisher Packt
ISBN-13 9781782167105
Pages 282 pages
Edition 1st Edition
Languages
Author (1):
Ryan "elfmaster" O'Neill Ryan "elfmaster" O'Neill
Profile icon Ryan "elfmaster" O'Neill

Table of Contents (17) Chapters

Learning Linux Binary Analysis
Credits
About the Author
Acknowledgments
About the Reviewers
www.PacktPub.com
Preface
The Linux Environment and Its Tools The ELF Binary Format Linux Process Tracing ELF Virus Technology – Linux/Unix Viruses Linux Binary Protection ELF Binary Forensics in Linux Process Memory Forensics ECFS – Extended Core File Snapshot Technology Linux /proc/kcore Analysis Index

ptrace requests


The ptrace system call has a libc wrapper like any other system call, so you may include ptrace.h and simply call ptrace while passing it a request and a process ID. The following details are not a replacement for the main pages of ptrace(2), although some descriptions were borrowed from the main pages.

Here's the synopsis:

#include <sys/ptrace.h>
long ptrace(enum __ptrace_request request, pid_t pid,
void *addr, void *data);

ptrace request types

Here is a list of requests that are most commonly used when using ptrace to interact with a process image:

lock icon The rest of the chapter is locked
Register for a free Packt account to unlock a world of extra content!
A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.
Unlock this book and the full library FREE for 7 days
Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of
Renews at $15.99/month. Cancel anytime}

Request

Description

PTRACE_ATTACH

Attach to the process specified in pid, making it a tracee of the calling process. The tracee is sent a SIGSTOP signal, but will not necessarily have stopped by the completion of this call. Use waitpid(2) to wait for the tracee to stop.

PTRACE_TRACEME

Indicates that this process is to be traced by its parent. A process probably shouldn't make this request if its parent isn't expecting...