syscall.sh / x64 / ptrace
ptrace
process trace
sys_ptrace(long request, long pid, unsigned long addr, unsigned long data)| number | 101 (0x65) |
|---|---|
| abi | 64 |
| entry point | sys_ptrace |
| since | Linux 3.3 |
| man page | ptrace(2) |
| source | elixir.bootlin.com |
Registers
| register | value |
|---|---|
rax | 101, the syscall number |
rdi | long request |
rsi | long pid |
rdx | unsigned long addr |
r10 | unsigned long data |
rax | the return value |
Then run syscall to enter the kernel.
Same syscall on other architectures
- x86 26
- arm64 117
- arm 26
- riscv64 117
- x32 1073742345
- loongarch64 117
- ppc64 26
- ppc 26
- s390x 26
- mips64 5099
- mipsn32 6099
- mipso32 4026
- alpha 26
- arc 117
- csky 117
- hexagon 117
- m68k 26
- microblaze 26
- nios2 117
- openrisc 117
- parisc 26
- sh 26
- sparc 26
- sparc64 26
- xtensa 160
Get this as JSON: https://api.syscall.sh/v2/syscalls/x64/ptrace