编辑(进展):
我正在尝试ptrace一个vsftpd守护进程。我有以下代码,它会附加到守护进程。然后成功显示第一个生成的进程的PID。但是,对于这个生成的进程的子进程,它返回的PID是2,3,..。但是程序确实捕获了生成的进程的退出,这让我觉得我快了。
有任何想法吗?
void * trace_process(void * pid){
pid_t child = atoi((char *) pid);
long orig_eax, eax;
int status;
int callmade = FALSE;
long opt = PTRACE_O_TRACEFORK;
long newpid;
long trace = ptrace(PTRACE_ATTACH,child,NULL,NULL);
ptrace(PTRACE_SETOPTIONS,child,NULL,opt);
if(trace == FALSE)
printf("Attached to %d\n",child);
while(TRUE) {
child = waitpid(-1, &status, __WALL);
if (status >> 16 == PTRACE_EVENT_FORK) {
ptrace(PTRACE_GETEVENTMSG, child, NULL, (long) &newpid);
ptrace(PTRACE_SYSCALL, newpid, NULL, NULL);
printf("Attached to offspring %ld\n", newpid);
}
else{
if(WIFEXITED(status))
printf("Child %d exited\n", child);
}
ptrace(PTRACE_SYSCALL,child, NULL, NULL);
}
}
示例输出:
Attached to 2015 // daemon
Attached to offspring 5302 // new connection handler
Attached to offspring 2 // should be authenticator
Child 5303 exited // authenticator exiting on successful login
Attached to offspring 3 // should be process serving files
Child 5304 exited // logout: process serving files
Child 5302 exited // connection closed
Attached to offspring 5305 // new connection handler
Attached to offspring 2 // ... repeat
Child 5306 exited
Attached to offspring 3
Child 5307 exited
Child 5305 exited
strace(1)
? - Nikolai Fetissov-f
选项吗? - Nikolai Fetissov