0

I'm trying out ptrace system calls, I just discovered Cross Memory Attach from Christopher Yeoh.

I wonder which one is better in term of performance between Cross Memory Attach and ptrace.

Thanks in advance

Pierre Le Guen
  • 93
  • 1
  • 6
  • 1
    use both -- they're not equivalent. use ptrace() to control the process and process_vm_*() instead of PTRACE_PEEK or POKE. –  Feb 25 '19 at 10:01
  • 1
    you can also use `/proc/PID/mem`, but since there's no multi-pread() or multi-pwrite(), the process_vm_*() funcs are nicer, even if the rationale for their existence is not convincing ;-) –  Feb 25 '19 at 10:09
  • Thank you very much @mosvy, why process_vm_*() is nicer for read & write than ptrace with PEEK and POKE please ? :) – Pierre Le Guen Feb 25 '19 at 10:17
  • 1
    I was saying that process_vm_*() are nicer than pread, pwrite, readv, etc on /proc/pid/mem. Their advantage vs ptrace_peekdata or pokedata is obvious -- the latter can only transfer one word at a time. I suggest you try them insyead of doing a dry assessment. –  Feb 25 '19 at 10:26

0 Answers0