Lion Cipher Lab
Build your own mini-strace from scratch with ptrace()
- Foundations
- Advanced
- ~90 min
- Free · no account required
Why it matters
strace, ltrace, gdb, and every Linux debugger and sandbox you will ever use are built on ONE system call: ptrace(2), 'process trace'. ptrace lets one process (the tracer) observe and control another (the tracee) — stop it, read and write its registers and memory, and single-step or run-to-next-syscall. Building a miniature strace with it yourself is the fastest way to turn 'debuggers are magic' into 'debuggers are a fork, a ptrace request, and a loop'. Here is the whole trick you will implement and see work: you fork a child; the child calls PTRACE_TRACEME ("parent, you may trace me") and…
What you'll learn
- understanding ptrace(2) as the single kernel primitive under strace, gdb and every Linux debugger
- using fork + PTRACE_TRACEME + execvp so a child asks its parent to trace it
- driving the tracer loop: PTRACE_SYSCALL + waitpid to stop the tracee at every syscall boundary
- reading a stopped process's register file with PTRACE_GETREGS
- decoding the x86-64 syscall convention: orig_rax = syscall number, rdi/rsi/rdx/r10/r8/r9 = arguments
- mapping raw syscall numbers to names to print a decoded trace line
- reading a string argument out of another process's memory with PTRACE_PEEKDATA
- distinguishing the syscall-ENTRY stop from the syscall-EXIT stop (the double stop)
- compiling and running a systems-C program against the kernel's tracing API with gcc
- judgment: when to hand-roll ptrace (sandboxes, seccomp/syscall filters, anti-analysis tracers) vs just run strace
Steps in this lab
- The one idea: one process can drive another, and the kernel hands you its registers
- Get a Linux x86-64 shell and a C compiler
- The design: fork, TRACEME in the child, PTRACE_SYSCALL loop in the parent
- Write the tracer: minitrace.c
- Run it — and see the entry/exit double stop with your own eyes
- Level up: reach into the tracee's memory and pull out a string
- The named failure modes (read this before you trust your own tracer)
- The judgment: when to hand-roll ptrace, and when to just run strace