CODEWITHSUNDEEP
linuxdebugging
user350556
user350556

Reputation: 107

is there some way to view the stack of a particular process?

I want to view the stack of a particular process in linux. It could be any process. I know that GDB could help, but I guess you need the source code to analyse the output.

Upvotes: 1

Views: 873

Answers (1)

Evan Teran
Evan Teran

Reputation: 90463

The only way to do it is with either a debugger or the debugging API (ptrace for linux).

Basically what you want to do is:

  • attach to the process (PTRACE_ATTACH)
  • get the thread context (PTRACE_GETREGS)
  • from the thread context get the value of the stack pointer (likely esp or rsp)
  • read memory from the process using ptrace, starting at the address of the stack pointer (PTRACE_PEEKDATA or /proc/<pid>/mem)
  • detach from the process (PTRACT_DETACH)

From there, the analysis is pretty much up to you. You may want to check out my debugger edb. For more details, of course you should man ptrace

Upvotes: 2

Related Questions