Implement a Simple Debugger with ptrace

ptrace: The Foundation of All Debuggers

ptrace (process trace) is the Linux system call that underpins GDB, strace, and every other debugger on Linux. It allows one process to observe and control the execution of another process.

Key ptrace Operations

• PTRACE_TRACEME: Child declares it should be traced by its parent
• PTRACE_PEEKDATA / PTRACE_POKEDATA: Read/write child memory
• PTRACE_SINGLESTEP: Execute exactly one instruction
• PTRACE_CONT: Continue execution
• PTRACE_GETREGS / PTRACE_SETREGS: Read/write registers

Setting breakpoints with INT3:

1. Save original byte with PTRACE_PEEKDATA
2. Replace with 0xCC (INT3) using PTRACE_POKEDATA
3. On hit, restore original byte, single-step, re-insert 0xCC

For This Exercise

You will implement a simple debugger using ptrace that forks a child, sets a breakpoint, and single-steps. Building a minimal debugger from scratch teaches you exactly what GDB does under the hood when you set a breakpoint or step through code.

Debugger Event Loop

The parent calls waitpid after each PTRACE_CONT or PTRACE_SINGLESTEP. When the child stops on SIGTRAP (breakpoint hit), the parent reads registers with PTRACE_GETREGS, inspects state, and decides whether to continue or step. GDB wraps this loop with user-friendly commands, but the ptrace syscall sequence is identical. Security policies like YAMA ptrace_scope restrict which processes can be traced on hardened systems.