Search code examples
system-callsnonblockingptrace

How to cancel a process waiting to return with ptrace()

I am trying to cancel when a process calls wait(), read(), recvfrom() or similar, because if I use ptrace on it, after the PTRACE_ATTACH and later PTRACE_CONT, my tracer becomes blocked until the function in the tracee returns. Also I think it happens the same with sleep().

Would be possible to cancel the call, or reproduce a fake return?

Thanks.

Solution

  • Yes, you should send a PTRACE_INTERRUPT. This will trigger the syscall to exit.

    To do this, you need not to waitpid on your tracee, because that would block you (the tracer) too.

    You can either have multiple threads: one that will block on the tracee, one that will "decide" to cancel the blocking syscall - e.g. a GUI thread that the user will press "cancel" (like a normal debugger, e.g. GDB).

    Or you can use PTRACE_SYSCALL to manually diagnose every syscall the program is doing and then decide preemptively if you wish to execute that syscall. This way you can decide to not run wait at all, or perhaps mock them by having your return value instead.