This Linux ptrace
example spawns a child process and manipulates it to run to completion. Otherwise, the child process will continue forever (until it's killed).
ptrace
is used by utilites like strace
as well as debuggers like gdb
and lldb
, which run as their own processes but spawn the target executable as a child process.
The disassemblies were generated by running objdump -d child > <arch>dump.txt
on an x86-64 machine and an AArch64 machine.
Note: while macOS does defines the ptrace
function, it's limited for our purposes. Other functions like task_for_pid
, thread_get_state
, and vm_read
/vm_write
are needed for this example, in addition to ptrace
.