|PTRACE(2)||System Calls Manual||PTRACE(2)|
ptrace — process
tracing and debugging
request, pid_t pid,
provides tracing and debugging facilities. It allows one process (the
process) to control another (the
process). Most of the time, the traced process runs normally, but when it
receives a signal (see
sigaction(2)), it stops. The tracing
process is expected to notice this via
wait(2) or the delivery of a
SIGCHLD signal, examine the state of the stopped
process, and cause it to terminate or continue as appropriate.
ptrace() is the mechanism by which all this
The request argument specifies
what operation is being performed; the meaning of the rest of the arguments
depends on the operation, but except for one special case noted below, all
calls are made by the tracing process, and the pid
argument specifies the process ID of the traced process.
request can be:
ptrace().) When a process has used this request and calls execve(2) or any of the routines built on it (such as execv(3)), it will stop before executing the first instruction of the new image. Also, any setuid or setgid bits on the executable being executed will be ignored.
(caddr_t)1to indicate that execution is to pick up where it left off. data provides a signal number to be delivered to the traced process as it resumes execution, or 0 if no signal is to be sent.
PT_CONTINUEhad been used with
SIGKILLgiven as the signal to be delivered.
PT_ATTACH) in that signals from the child are delivered to the parent as Mach exceptions (see EXC_SOFT_SIGNAL).
Some requests can cause
ptrace() to return
-1 as a non-error value; to disambiguate,
errno can be set to 0 before the call and checked
afterwards. The possible errors are:
PT_CONTINUEwas neither 0 nor a legal signal number.
PT_SETFPREGSwas attempted on a process with no valid register set. (This is normally true only of system processes.)
PT_ATTACHEXCwas attempted on a process that was already being traced.
PT_ATTACHEXC) specified a process that wasn't stopped.
PT_ATTACHEXC) attempted to manipulate a process that wasn't being traced at all.
PT_ATTACHEXCon a process in violation of the requirements listed under
|March 25, 2015||macOS 14.1|