ptrace 分析[基于Android 8.0 msm-4.4]

1.ptrace 基础用法

从 man开始：

$man 2 ptrace

PTRACE(2)                                                                       Linux Programmer's Manual                                                                       PTRACE(2)

NAME
       ptrace - process trace
SYNOPSIS
       #include <sys/ptrace.h>
       long ptrace(enum __ptrace_request request, pid_t pid, void *addr, void *data);
DESCRIPTION
       The  ptrace() system call provides a means by which one process (the "tracer") may observe and control the execution of another process (the "tracee"), and examine and change the tracee's memory and registers.  It is primarily used to implement breakpoint debugging and system call tracing.

       A tracee first needs to be attached to the tracer.  Attachment and subsequent commands are per thread: in a multithreaded process, every thread can be individually attached to  a (potentially  different) tracer, or left not attached and thus not debugged.  Therefore, "tracee" always means "(one) thread", never "a (possibly multithreaded) process".  

Ptrace commands are always sent to a specific tracee using a call of the form

           ptrace(PTRACE_foo, pid, ...)
       where pid is the thread ID of the corresponding Linux thread.
       (Note that in this page, a "multithreaded process" means a thread group consisting of threads created using the clone(2) CLONE_THREAD flag.)
       A process can initiate a trace by calling fork(2) and having the resulting child do a PTRACE_TRACEME, followed (typically) by an execve(2).  Alternatively, one process  may  commence tracing another process using PTRACE_ATTACH or PTRACE_SEIZE.
       While being traced, the tracee will stop each time a signal is delivered, even if the signal is being ignored.  (An exception is SIGKILL, which has its usual effect.) The tracer will be notified at its next call to waitpid(2) (or one of the related "wait" system calls); that call will return a status value containing information that indicates the  cause of  the  stop in the tracee.  While the tracee is stopped, the tracer can use various ptrace requests to inspect and modify the tracee.  The tracer then causes the tracee to continue, optionally ignoring the delivered signal (or even delivering a different signal instead).
       If the PTRACE_O_TRACEEXEC option is not in effect, all successful calls to execve(2) by the traced process will cause it to be sent a SIGTRAP signal, giving the parent  a  chanceto gain control before the new program begins execution.
       When the tracer is finished tracing, it can cause the tracee to continue executing in a normal, untraced mode via PTRACE_DETACH.

       The value of request determines the action to be performed:

       .....

       简单来讲， ptrace 就是用来提供进程跟踪/控制的一个系统调用，允许 tracer 观察/修改 tracee的 Memory & Registers；

       它主要用来实现 断点调试 / 系统调用跟踪 的功能。

        tracee 进程被跟踪的前提(参考 cap_ptrace_traceme 函数)：

1. 1. 它是 tracer的子进程，tracer 拥有和 tracee 相同的或者更高一级的 user_ns，并且tracer 拥有当前 tracee的所有capabilities
   2. 或者，tracer 拥有对 tracee 的 ptrace 权限

long ptrace(enum __ptrace_request request, pid_t pid, void *addr, void *data);

其中，ptrace 请求 request 决定了 ptrace系统调用的功能，下面是比较常用的一些请求及说明：

ptrace requests

requests	comment
PTRACE_TRACEME	由 tracee进程发出该请求，表示tracee进程可被父进程 trace，除了该请求，其他的请求均由 tracer进程调用；
PTRACE_PEEKTEXT, PTRACE_PEEKDATA	Read  a word at the address addr in the tracee's memory, returning the word as the result of the ptrace() call. 当前这个两个请求完全相等。data 参数忽略。
PTRACE_PEEKUSER	从 USER区域读出一个 word，addr是偏移量，读取的word作为 ptrace返回值。
PTRACE_POKETEXT, PTRACE_POKEDATA	向 tracee的内存写入一个 word，内存地址是 addr，data是要写入的数据
PTRACE_POKEUSER