How debuggers really work
Follow us We have the truth Image by : opensource.com A debugger is one of those pieces of software that most, if not every, developer uses at least once during their software engineering career, but how many of you know how they actually work? During my talk at linux.conf.au 2018 in Sydney, I will be talking about writing a debugger from scratch... in Rust ! In this article, the terms debugger/tracer are interchangeably. "Tracee" refers to the process being traced by the tracer. The ptrace system call Most debuggers heavily rely on a system call known as ptrace(2), which has the prototype:long ptrace(enum __ptrace_request request, pid_t pid, void *addr, void *data); This is a system call that can manipulate almost all aspects of a process; however, before the debugger can attach to a process, the "tracee" has to call ptrace with the request PTRACE_TRACEME. This tells Linux that it is legitimate for the parent to attach via ptrace to thi...