0

I'm trying to use ptrace apis to control the execution of child process. As a part of it, there are like few things I need to do, at first I need to trace the child process right from the beginning of the child's execution, hence, I am using PTRACE_TRACEME. Besides that, I also need to use a framework called as compel (from CRIU) for code injection into the child process during runtime. The problem with using this framework is that, it uses ptrace apis PTRACE_SEIZE & PTRACE_INTERRUPT to attach and inject code into the child process. Hence my logic of using the PTRACE_TRACEME to debug right from the beginning of child process execution and to use a framework that starts debugging with PTRACE_SEIZE isn't working out.

I need a suggestion of overcoming this logical bottleneck, which is how to switch from PTRACE_TRACEME to PTRACE_SEIZE & PTRACE_INTERRUPT so that I can leverage the framework that offers me sophistication of injecting parasitic code on the fly.

One approach that I tried was tweaking the framework so that it will be compatible with PTRACE_TRACEME, but it gives me hard time solving it, as the code itself is immensely large & solving it seems like a long time...

Another approach is attach to the child from the beginning of the child execution with PTRACE_SEIZE & PTRACE_INTERRUPT so that it would be easy to use the framework directly.

Any idea is welcome, either using PTRACE_SEIZE & PTRACE_INTERRUPT from the beginning of the child execution or shifting from PTRACE_TRACEME to PTRACE_SEIZE & PTRACE_INTERRUPT

Abilesh Sundarasamy
  • 27
  • 7
  • I don't get exactly what is the problem here. If you just fork, and in the child raise a `SIGSTOP`, then you should have all the time you want to invoke the framework in the parent to attach to the child. Did you try this? – Marco Bonelli Jul 29 '22 at 17:09
  • No the problem with that approach is that before raising SIGSTOP from parent, the child may execute past the instruction which I need to trace with, doesn't it? – Abilesh Sundarasamy Jul 29 '22 at 21:27
  • No, the signal is raised by the child on itself. You fork and in the child raise a SIGSTOP (or do a PTRACE_TRACEME) before doing an execve of whatever program you need to trace, then you have all the time in the parent to start the framework and let that attach. – Marco Bonelli Jul 30 '22 at 00:31
  • Oh sorry I forgot to mention I am not supposed to do any changes in the child process fyi – Abilesh Sundarasamy Jul 30 '22 at 13:36
  • 1
    You don't need to do any change to the child process... you can very well `fork` and then `execve` the child process as is. See this answer of mine https://stackoverflow.com/a/64024240/3889449 – Marco Bonelli Jul 30 '22 at 15:14
  • Hi @MarcoBonelli, thanks a lot for your comments. I have an idea now, I will try in sometime and let you know of the result – Abilesh Sundarasamy Aug 01 '22 at 14:47

0 Answers0