syscall.sh / x86 / ptrace
ptrace
process trace
sys_ptrace(long request, long pid, unsigned long addr, unsigned long data)| number | 26 (0x1a) |
|---|---|
| abi | i386 |
| entry point | sys_ptrace |
| since | Linux 3.3 |
| man page | ptrace(2) |
| source | elixir.bootlin.com |
Registers
| register | value |
|---|---|
eax | 26, the syscall number |
ebx | long request |
ecx | long pid |
edx | unsigned long addr |
esi | unsigned long data |
eax | the return value |
Then run int 0x80 to enter the kernel.
Same syscall on other architectures
- x64 101
- arm64 117
- arm 26
- riscv64 117
- x32 1073742345
- loongarch64 117
- ppc64 26
- ppc 26
- s390x 26
- mips64 5099
- mipsn32 6099
- mipso32 4026
- alpha 26
- arc 117
- csky 117
- hexagon 117
- m68k 26
- microblaze 26
- nios2 117
- openrisc 117
- parisc 26
- sh 26
- sparc 26
- sparc64 26
- xtensa 160
Get this as JSON: https://api.syscall.sh/v2/syscalls/x86/ptrace