ptrace 在 Linux 中如何工作

# Linux中的ptrace：追踪进程的神器

c
#include 
#include 
#include 
#include 
#include 
int main() {
    pid_t child_pid;
    long original_data;
    child_pid = fork();
    if (child_pid == 0) {
        // Child process
        printf("Child process executing...%
");
        sleep(2);
        return 0;
    } else {
        // Parent process
        printf("Parent process attaching to child...%
");
        ptrace(PTRACE_ATTACH, child_pid, NULL, NULL);
        waitpid(child_pid, NULL, 0);
        printf("Parent process attached.%
");
        // Example: Read data from the child's memory
        original_data = ptrace(PTRACE_PEEKDATA, child_pid, (void*)0x400000, NULL);
        printf("Original data at address 0x400000: %lx%
", original_data);
        // Example: Modify data in the child's memory
        ptrace(PTRACE_POKEDATA, child_pid, (void*)0x400000, (original_data & 0xFFFFFFFFFFFFFF00) | 0xAA);
        printf("Data at address 0x400000 modified.%
");
        // Detach from the child process
        ptrace(PTRACE_DETACH, child_pid, NULL, NULL);
        printf("Parent process detached.%
");
    }
    return 0;
}