Question

i want to catch information from user defined function using ptrace() calls.

but function address is not stable(because ASLR).

how can i get another program’s function information like gdb programmatically?

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/user.h>
#include <sys/wait.h>
#include <sys/ptrace.h>
#include <dlfcn.h>
#include <errno.h>

void error(char *msg)
{
    perror(msg);
    exit(-1);
}

int main(int argc, char **argv)
{
    long ret = 0;
    void *handle;
    pid_t pid = 0;
    struct user_regs_struct regs;
    int *hackme_addr = 0;

    pid = atoi(argv[1]);

    ret = ptrace(PTRACE_ATTACH, pid, NULL, NULL);
    if(ret<0)
    {
        error("ptrace() error");
    }

    ret = waitpid(pid, NULL, WUNTRACED);
    if(ret<0)
    {
        error("waitpid ()");
    }

    ret = ptrace(PTRACE_GETREGS, pid, NULL, &regs);
    if(ret<0)
    {
        error("GETREGS error");
    }

    printf("EIP : 0x%x\n", (int)regs.eip);

    ptrace(PTRACE_DETACH, pid, NULL, NULL);

    return 0;
}

Answer 1

ptrace is a bit ugly, but it can be useful.

Here’s a ptrace example program; it’s used to make I/O-related system calls pause.
http://stromberg.dnsalias.org/~strombrg/slowdown/

You could of course also study gdb, but ISTR it’s pretty huge.

You might also check out strace and ltrace, perhaps especially ltrace since it lists symbols.

HTH