Linux command
ptrace 命令
文本
复制后可按需替换文件名、目录或参数。
常用示例
Trace system calls (via strace)
strace [command]
Attach to process
strace -p [pid]
Trace child processes
strace -f [command]
Trace specific calls
strace -e [open,read,write] [command]
说明
ptrace (process trace) is a Linux system call that allows one process (the tracer) to observe and control the execution of another process (the tracee). It can inspect and modify the tracee's memory, registers, and signal delivery. It is the underlying mechanism used by debuggers like gdb and system call tracers like strace and ltrace. The tracee must either call PTRACE_TRACEME or be attached via PTRACE_ATTACH/PTRACE_SEIZE.
FAQ
What is the ptrace command used for?
ptrace (process trace) is a Linux system call that allows one process (the tracer) to observe and control the execution of another process (the tracee). It can inspect and modify the tracee's memory, registers, and signal delivery. It is the underlying mechanism used by debuggers like gdb and system call tracers like strace and ltrace. The tracee must either call PTRACE_TRACEME or be attached via PTRACE_ATTACH/PTRACE_SEIZE.
How do I run a basic ptrace example?
Run `strace [command]` in a terminal, then adjust file names, paths, flags, or remote targets for your system.
Where can I find more ptrace examples?
This page includes 4 examples for ptrace, plus related commands for nearby Linux tasks.