On Tue, 1 May 2001, Richard F Weber wrote:
See this is where I start seeming to have problems. I can open
/proc/*/mem & lseek, but reads come back as "No such process". However,
if I first do a ptrace(PTRACE_ATTACH), then I can read the data, but the
process stops. I've kind of dug through the sys_ptrace() code under
/usr/src/linux/arch/i386/kernel/ptrace.c, and can see and understand
generally what it's doing, but that's getting into serious kernel-land
stuff. I wouldn't expect it to be this difficult to just open up
another processes /proc/*/mem file to read data from.
Is there something obvious I'm missing? It seems to keep pointing back
to ptrace & /proc/*/mem are very closely related (ie: the same)
including stopping of the child.
OK, here's something I really don't understand. Suppose that I tell your
debugger to tell me when in the executed program foo becomes greater than
bar[0] + 14. Or when cyclic list foo becomes longer than 1 element
(i.e. foo.next != foo.prev).
How do you do that if program is running? If you don't guarantee that
it doesn't run during the access to its memory (moreover, between sever
such accesses) - the data you get is worthless.