首先看sys/ptrace.h

/bionic/libc/include/sys/ptrace.h

我们在调用的时候使用的是PTRACE_的导出符号，glibc也导出了PT_开头的符号。PTRACE_开头的符号定义在/bionic/libc/kernel/uapi/linux/ptrace.h中

都是int型的数字，回到ptrace函数的定义，头文件中写的是一个不定参数的形式

long ptrace(int, ...);

继续跟进__ptrace函数

__ptrace函数使用汇编实现，其中____NR_ptrace是系统调用号，根据调用号进入kernel层即linux内核的逻辑。此处__NR_ptrace的调用号为26，swi #0 为产生中断，切换到内核模式

内核的实现是在/kernel/ptrace.c中

PTRACE_TRACEME调用

static int ptrace_traceme(void)

382{

383 int ret = -EPERM;

384

385 write_lock_irq(&tasklist_lock);

386 /* Are we already being traced? */

387 if (!current->ptrace) {

388 ret = security_ptrace_traceme(current->parent);

389 /*

390 * Check PF_EXITING to ensure ->real_parent has not passed

391 * exit_ptrace(). Otherwise we don't report the error but

392 * pretend ->real_parent untraces us right after return.

393 */

394 if (!ret && !(current->real_parent->flags & PF_EXITING)) {

395 current->ptrace = PT_PTRACED;

396 __ptrace_link(current, current->real_parent);

397 }

398 }

399 write_unlock_irq(&tasklist_lock);

400

401 return ret;

402}

__ptrace_link函数

void __ptrace_link(struct task_struct *child, struct task_struct *new_parent)

38{

39 BUG_ON(!list_empty(&child->ptrace_entry));

40 list_add(&child->ptrace_entry, &new_parent->ptraced);

41 child->parent = new_parent;

42}

函数首先判断当前进程有没有正在被traced，如果为否进行一系列安全检查将当前进程设置为PT_PTRACED，并调用__ptrace_link函数将子进程链接到父进程的ptrace链表中。之后再进行系统调用的时候，内核就会判断当前进程是否被设置为traced，如果是内核将向该进程发送SIGTRAP信号。该信号将导致当前进程停止。并将控制权交给父进程。

PTRACE_ATTACH调用ptrace_attach

static int ptrace_attach(struct task_struct *task, long request,

274 unsigned long addr,

275 unsigned long flags)

276{

277 bool seize = (request == PTRACE_SEIZE);

278 int retval;

279

280 retval = -EIO;

281 if (seize) {

282 if (addr != 0)

283 goto out;

284 if (flags & ~(unsigned long)PTRACE_O_MASK)

285 goto out;

286 flags = PT_PTRACED | PT_SEIZED | (flags << PT_OPT_FLAG_SHIFT);

287 } else {

288 flags = PT_PTRACED;

289 }

290

291 audit_ptrace(task);

292

293 retval = -EPERM;

294 if (unlikely(task->flags & PF_KTHREAD))

295 goto out;

296 if (same_thread_group(task, current))

297 goto out;

298

299 /*

300 * Protect exec's credential calculations against our interference;

301 * SUID, SGID and LSM creds get determined differently

302 * under ptrace.

303 */

304 retval = -ERESTARTNOINTR;

305 if (mutex_lock_interruptible(&task->signal->cred_guard_mutex))

306 goto out;

307

308 task_lock(task);

309 retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH);

310 task_unlock(task);

311 if (retval)

312 goto unlock_creds;

313

314 write_lock_irq(&tasklist_lock);

315 retval = -EPERM;

316 if (unlikely(task->exit_state))

317 goto unlock_tasklist;

318 if (task->ptrace)

319 goto unlock_tasklist;

320

321 if (seize)

322 flags |= PT_SEIZED;

323 rcu_read_lock();

324 if (ns_capable(__task_cred(task)->user_ns, CAP_SYS_PTRACE))

325 flags |= PT_PTRACE_CAP;

326 rcu_read_unlock();

327 task->ptrace = flags;

328

329 __ptrace_link(task, current);

330

331 /* SEIZE doesn't trap tracee on attach */

332 if (!seize)

333 send_sig_info(SIGSTOP, SEND_SIG_FORCED, task);

334

335 spin_lock(&task->sighand->siglock);

336

337 /*

338 * If the task is already STOPPED, set JOBCTL_TRAP_STOP and

339 * TRAPPING, and kick it so that it transits to TRACED. TRAPPING

340 * will be cleared if the child completes the transition or any

341 * event which clears the group stop states happens. We'll wait

342 * for the transition to complete before returning from this

343 * function.

344 *

345 * This hides STOPPED -> RUNNING -> TRACED transition from the

346 * attaching thread but a different thread in the same group can

347 * still observe the transient RUNNING state. IOW, if another

348 * thread's WNOHANG wait(2) on the stopped tracee races against

349 * ATTACH, the wait(2) may fail due to the transient RUNNING.

350 *

351 * The following task_is_stopped() test is safe as both transitions

352 * in and out of STOPPED are protected by siglock.

353 */

354 if (task_is_stopped(task) &&

355 task_set_jobctl_pending(task, JOBCTL_TRAP_STOP | JOBCTL_TRAPPING))

356 signal_wake_up_state(task, __TASK_STOPPED);

357

358 spin_unlock(&task->sighand->siglock);

359

360 retval = 0;

361 unlock_tasklist:

362 write_unlock_irq(&tasklist_lock);

363 unlock_creds:

364 mutex_unlock(&task->signal->cred_guard_mutex);

365 out:

366 if (!retval) {

367 wait_on_bit(&task->jobctl, JOBCTL_TRAPPING_BIT,

368 TASK_UNINTERRUPTIBLE);

369 proc_ptrace_connector(task, PTRACE_ATTACH);

370 }

371

372 return retval;

373}

整个函数的流程总结如下(分析来自linux3.5.4 ptrace源码分析二 新增部分修改)

1． 判断请求是PTRACE_SEIZE还是PTRACE_ATTACH，如果ptrace请求为PTRACE_SEIZE，则检查其参数是否正确，参数有误则退出

2． 判断task进程是否为kernel thread(PF_KTHREAD)，调用same_thread_group(task,current)，判断task是否和current进程在同一个线程组，查看current进程是否有权限追踪task进程，不符合要求则退出

3． 设置子进程task->ptrace = PT_TRACED，被跟踪状态，如果当前进程拥有CAP_SYS_PTRACED，设置task->ptrace |= PT_TRACE_CAP

4． 调用__ptrace_link(task, current),将task->ptrace_entry链接到current->ptraced链表中，并设置当前进程为被跟踪进程的新的父进程。

5． 如果是PTRACE_ATTACH请求(PTRACE_SEIZE请求不会停止被追踪进程)，则调用send_sig_info(SIGSTOP,SEND_SIG_FORCED, task);发送SIGSTOP信号，中止task运行，设置task->state为TASK_STOPPED

6． 等待task->jobctl的JOBCTL_TRAPPING_BIT位被清零，阻塞时进程状态被设置为TASK_UNINTERRUPTIBLE并引发进程调度

PTRACE_ATTACH处理的方式与PTRACE_TRACEME处理的方式不同，PTRACE_ATTACH会使父进程向子进程发送SIGTRAP信号，如果子进程停止，父进程的wait操作则会被唤醒，从而成功attach。

而PTRACE_TRACEME只是表明该进程(child)想被trace的意愿。如果一个进程调用了PTRACE_TRACEME，那么该进程处理信号的方式将会变得不同。比如：如果一个进程正在运行，此时输入ctrl+c(SIGINT),则该进程直接退出。但是，如果该进程中有ptrace(PTRACE_TRACEME,0，NULL,NULL)。即该进程主动要求被跟踪，那么，当输入CTRL+C时，该进程将会处于stopped的状态。

PTRACE_PEEKDATA/PEEKTEXT

PTRACE_POKEDATA/POKETEXT

int generic_ptrace_peekdata(struct task_struct *tsk, unsigned long addr,

1076 unsigned long data)

1077 {

1078 unsigned long tmp;

1079 int copied;

1080

1081 copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);

1082 if (copied != sizeof(tmp))

1083 return -EIO;

1084 return put_user(tmp, (unsigned long __user *)data);

1085 }

7int generic_ptrace_pokedata(struct task_struct *tsk, unsigned long addr,

1088 unsigned long data)

1089{

1090 int copied;

1091

1092 copied = access_process_vm(tsk, addr, &data, sizeof(data), 1);

1093 return (copied == sizeof(data)) ? 0 : -EIO;

1094}

1095

int access_process_vm(struct task_struct *tsk, unsigned long addr, void *buf, int len, int write)

2058 {

2059 struct mm_struct *mm;

2060

2061 if (addr + len < addr)

2062 return 0;

2063

2064 mm = get_task_mm(tsk);

2065 if (!mm)

2066 return 0;

2067

2068 len = __access_remote_vm(tsk, mm, addr, buf, len, write);

2069

2070 mmput(mm);

2071 return len;

2072 }

static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,

2006 unsigned long addr, void *buf, int len, int write)

2007 {

2008 struct vm_area_struct *vma;

2009

2010 down_read(&mm->mmap_sem);

2011

2012 /* the access must start within one of the target process's mappings */

2013 vma = find_vma(mm, addr);

2014 if (vma) {

2015 /* don't overrun this mapping */

2016 if (addr + len >= vma->vm_end)

2017 len = vma->vm_end - addr;

2018

2019 /* only read or write mappings where it is permitted */

2020 if (write && vma->vm_flags & VM_MAYWRITE)

2021 copy_to_user_page(vma, NULL, addr,

2022 (void *) addr, buf, len);

2023 else if (!write && vma->vm_flags & VM_MAYREAD)

2024 copy_from_user_page(vma, NULL, addr,

2025 buf, (void *) addr, len);

2026 else

2027 len = 0;

2028 } else {

2029 len = 0;

2030 }

2031

2032 up_read(&mm->mmap_sem);

2033

2034 return len;

2035 }

2#undef copy_to_user_page

83static inline void copy_to_user_page(struct vm_area_struct *vma,

84 struct page *page,

85 unsigned long vaddr,

86 void *dst, void *src, int len)

87{

88 memcpy(dst, src, len);

89 if (vma->vm_flags & VM_EXEC) {

90 flush_icache_range((unsigned long) dst,

91 (unsigned long) dst + len);

92 }

93}

获取内存的值和写入内存值逻辑上差不多，内核是通过操作区域的属性来判断写入还是读取。最终由memcpy函数实现内存的拷贝。