Android ptrace函数的实现

首先看sys/ptrace.h

/bionic/libc/include/sys/ptrace.h

我们在调用的时候使用的是PTRACE_的导出符号，glibc也导出了PT_开头的符号。PTRACE_开头的符号定义在/bionic/libc/kernel/uapi/linux/ptrace.h中

都是int型的数字，回到ptrace函数的定义，头文件中写的是一个不定参数的形式
long ptrace(int, ...);

继续跟进__ptrace函数

__ptrace函数使用汇编实现，其中____NR_ptrace是系统调用号，根据调用号进入kernel层即linux内核的逻辑。此处__NR_ptrace的调用号为26，swi #0 为产生中断，切换到内核模式

内核的实现是在/kernel/ptrace.c中
PTRACE_TRACEME调用

   static int ptrace_traceme(void)
382{
383 int ret = -EPERM;
384
385 write_lock_irq(&tasklist_lock);
386 /* Are we already being traced? */
387 if (!current->ptrace) {
388     ret = security_ptrace_traceme(current->parent);
389     /*
390      * Check PF_EXITING to ensure ->real_parent has not passed
391      * exit_ptrace(). Otherwise we don't report the error but
392      * pretend ->real_parent untraces us right after return.
393      */
394     if (!ret && !(current->real_parent->flags & PF_EXITING)) {
395         current->ptrace = PT_PTRACED;
396         __ptrace_link(current, current->real_parent);
397     }
398 }
399 write_unlock_irq(&tasklist_lock);
400
401 return ret;
402}

__ptrace_link函数

void __ptrace_link(struct task_struct *child, struct task_struct *new_parent)
38{
39  BUG_ON(!list_empty(&child->ptrace_entry));
40  list_add(&child->ptrace_entry, &new_parent->ptraced);
41  child->parent = new_parent;
42}

函数首先判断当前进程有没有正在被traced，如果为否进行一系列安全检查将当前进程设置为PT_PTRACED，并调用__ptrace_link函数将子进程链接到父进程的ptrace链表中。之后再进行系统调用的时候，内核就会判断当前进程是否被设置为traced，如果是内核将向该进程发送SIGTRAP信号。该信号将导致当前进程停止。并将控制权交给父进程。

PTRACE_ATTACH调用ptrace_attach

static int ptrace_attach(struct task_struct *task, long request,
274          unsigned long addr,
275          unsigned long flags)
276{
277 bool seize = (request == PTRACE_SEIZE);
278 int retval;
279
280 retval = -EIO;
281 if (seize) {
282     if (addr != 0)
283         goto out;
284     if (flags & ~(unsigned long)PTRACE_O_MASK)
285         goto out;
286     flags = PT_PTRACED | PT_SEIZED | (flags << PT_OPT_FLAG_SHIFT);
287 } else {
288     flags = PT_PTRACED;
289 }
290
291 audit_ptrace(task);
292
293 retval = -EPERM;
294 if (unlikely(task->flags & PF_KTHREAD))
295     goto out;
296 if (same_thread_group(task, current))
297     goto out;
298
299 /*
300  * Protect exec's credential calculations against our interference;
301  * SUID, SGID and LSM creds get determined differently
302  * under ptrace.
303  */
304 retval = -ERESTARTNOINTR;
305 if (mutex_lock_interruptible(&task->signal->cred_guard_mutex))
306     goto out;
307
308 task_lock(task);
309 retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH);
310 task_unlock(task);
311 if (retval)
312     goto unlock_creds;
313
314 write_lock_irq(&tasklist_lock);
315 retval = -EPERM;
316 if (unlikely(task->exit_state))
317     goto unlock_tasklist;
318 if (task->ptrace)
319     goto unlock_tasklist;
320
321 if (seize)
322     flags |= PT_SEIZED;
323 rcu_read_lock();
324 if (ns_capable(__task_cred(task)->user_ns, CAP_SYS_PTRACE))
325     flags |= PT_PTRACE_CAP;
326 rcu_read_unlock();
327 task->ptrace = flags;
328
329 __ptrace_link(task, current);
330
331 /* SEIZE doesn't trap tracee on attach */
332 if (!seize)
333     send_sig_info(SIGSTOP, SEND_SIG_FORCED, task);
334
335 spin_lock(&task->sighand->siglock);
336
337 /*
338  * If the task is already STOPPED, set JOBCTL_TRAP_STOP and
339  * TRAPPING, and kick it so that it transits to TRACED.  TRAPPING
340  * will be cleared if the child completes the transition or any
341  * event which clears the group stop states happens.  We'll wait
342  * for the transition to complete before returning from this
343  * function.
344  *
345  * This hides STOPPED -> RUNNING -> TRACED transition from the
346  * attaching thread but a different thread in the same group can
347  * still observe the transient RUNNING state.  IOW, if another
348  * thread's WNOHANG wait(2) on the stopped tracee races against
349  * ATTACH, the wait(2) may fail due to the transient RUNNING.
350  *
351  * The following task_is_stopped() test is safe as both transitions
352  * in and out of STOPPED are protected by siglock.
353  */
354 if (task_is_stopped(task) &&
355     task_set_jobctl_pending(task, JOBCTL_TRAP_STOP | JOBCTL_TRAPPING))
356     signal_wake_up_state(task, __TASK_STOPPED);
357
358 spin_unlock(&task->sighand->siglock);
359
360 retval = 0;
361 unlock_tasklist:
362 write_unlock_irq(&tasklist_lock);
363 unlock_creds:
364 mutex_unlock(&task->signal->cred_guard_mutex);
365 out:
366 if (!retval) {
367     wait_on_bit(&task->jobctl, JOBCTL_TRAPPING_BIT,
368             TASK_UNINTERRUPTIBLE);
369     proc_ptrace_connector(task, PTRACE_ATTACH);
370 }
371
372 return retval;
373}

整个函数的流程总结如下（分析来自linux3.5.4 ptrace源码分析二 新增部分修改）
1． 判断请求是PTRACE_SEIZE还是PTRACE_ATTACH，如果ptrace请求为PTRACE_SEIZE，则检查其参数是否正确，参数有误则退出
2． 判断task进程是否为kernel thread(PF_KTHREAD)，调用same_thread_group(task,current)，判断task是否和current进程在同一个线程组，查看current进程是否有权限追踪task进程，不符合要求则退出
3． 设置子进程task->ptrace = PT_TRACED，被跟踪状态，如果当前进程拥有CAP_SYS_PTRACED，设置task->ptrace |= PT_TRACE_CAP
4． 调用__ptrace_link(task, current),将task->ptrace_entry链接到current->ptraced链表中，并设置当前进程为被跟踪进程的新的父进程。
5． 如果是PTRACE_ATTACH请求（PTRACE_SEIZE请求不会停止被追踪进程），则调用send_sig_info(SIGSTOP,SEND_SIG_FORCED, task);发送SIGSTOP信号，中止task运行，设置task->state为TASK_STOPPED
6． 等待task->jobctl的JOBCTL_TRAPPING_BIT位被清零，阻塞时进程状态被设置为TASK_UNINTERRUPTIBLE并引发进程调度
PTRACE_ATTACH处理的方式与PTRACE_TRACEME处理的方式不同，PTRACE_ATTACH会使父进程向子进程发送SIGTRAP信号，如果子进程停止，父进程的wait操作则会被唤醒，从而成功attach。

而PTRACE_TRACEME只是表明该进程（child）想被trace的意愿。如果一个进程调用了PTRACE_TRACEME，那么该进程处理信号的方式将会变得不同。比如：如果一个进程正在运行，此时输入ctrl+c(SIGINT),则该进程直接退出。但是，如果该进程中有ptrace（PTRACE_TRACEME,0，NULL,NULL）。即该进程主动要求被跟踪，那么，当输入CTRL+C时，该进程将会处于stopped的状态。

PTRACE_PEEKDATA/PEEKTEXT
PTRACE_POKEDATA/POKETEXT

int generic_ptrace_peekdata(struct task_struct *tsk, unsigned long addr,
1076                unsigned long data)
1077 {
1078    unsigned long tmp;
1079    int copied;
1080
1081    copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
1082    if (copied != sizeof(tmp))
1083        return -EIO;
1084    return put_user(tmp, (unsigned long __user *)data);
1085 }

7int generic_ptrace_pokedata(struct task_struct *tsk, unsigned long addr,
1088                unsigned long data)
1089{
1090    int copied;
1091
1092    copied = access_process_vm(tsk, addr, &data, sizeof(data), 1);
1093    return (copied == sizeof(data)) ? 0 : -EIO;
1094}
1095

int access_process_vm(struct task_struct *tsk, unsigned long addr, void *buf, int len, int write)
2058 {
2059    struct mm_struct *mm;
2060
2061    if (addr + len < addr)
2062        return 0;
2063
2064    mm = get_task_mm(tsk);
2065    if (!mm)
2066        return 0;
2067
2068    len = __access_remote_vm(tsk, mm, addr, buf, len, write);
2069
2070    mmput(mm);
2071    return len;
2072 }

static int __access_remote_vm(struct task_struct *tsk, struct mm_struct *mm,
2006        unsigned long addr, void *buf, int len, int write)
2007 {
2008    struct vm_area_struct *vma;
2009
2010    down_read(&mm->mmap_sem);
2011
2012    /* the access must start within one of the target process's mappings */
2013    vma = find_vma(mm, addr);
2014    if (vma) {
2015        /* don't overrun this mapping */
2016        if (addr + len >= vma->vm_end)
2017            len = vma->vm_end - addr;
2018
2019        /* only read or write mappings where it is permitted */
2020        if (write && vma->vm_flags & VM_MAYWRITE)
2021            copy_to_user_page(vma, NULL, addr,
2022                     (void *) addr, buf, len);
2023        else if (!write && vma->vm_flags & VM_MAYREAD)
2024            copy_from_user_page(vma, NULL, addr,
2025                        buf, (void *) addr, len);
2026        else
2027            len = 0;
2028    } else {
2029        len = 0;
2030    }
2031
2032    up_read(&mm->mmap_sem);
2033
2034    return len;
2035 }

2#undef copy_to_user_page
83static inline void copy_to_user_page(struct vm_area_struct *vma,
84                       struct page *page,
85                       unsigned long vaddr,
86                       void *dst, void *src, int len)
87{
88  memcpy(dst, src, len);
89  if (vma->vm_flags & VM_EXEC) {
90      flush_icache_range((unsigned long) dst,
91      (unsigned long) dst + len);
92  }
93}

获取内存的值和写入内存值逻辑上差不多，内核是通过操作区域的属性来判断写入还是读取。最终由memcpy函数实现内存的拷贝。