Re: getting ebp from another process ?

[James Stevenson <james@stev.org>]

> > under linux is it possible to get ebp from another
> > process without attaching a debugger to it ?
> Depends on what you mean by attaching a debugger.  If you just want
> avoid starting an external program like gdb, you can do it with
> ptrace:
> 
> struct user_regs_struct regs_struct;
> 
> ptrace(PTRACE_ATTACH, target_pid, NULL, NULL);
> waitpid(target_pid, NULL, WUNTRACED);
> ptrace(PTRACE_GETREGS, target_pid, NULL, &regs_struct);
> target_ebp = regs_struct.ebp;

yeah this is where the problem lies. because there is
already another process using ptrace on the process i want the info
from.

i will probably just end up modifiing the host kernel
so i can get the values from /proc/<pid>/ebp