ptrace에서 open 파일이름 알아내기

#include <assert.h>
#include <sys/ptrace.h>
#include <linux/ptrace.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
#include <linux/user.h>
#include <sys/syscall.h>
#include <syscall.h>
#include <sys/reg.h>
#include <stdio.h>
#include <stdlib.h>
 
#ifdef __x86_64__
#define SYSCALL_OFF (ORIG_RAX * 8)
#else
#define SYSCALL_OFF (ORIG_EAX * 4)
#endif
 
void checked (char const * const s, int const r) { if (r == -1) { perror(s); abort(); } }
 
int main()
{
  struct user_regs_struct regs;
 
  pid_t const child = fork();
 
  checked("fork", child);
 
  if(child == 0)
  {
    checked("ptrace", ptrace(PTRACE_TRACEME, 0, NULL, NULL));
    checked("execl", execl("/usr/bin/whoami", "whoami", NULL));
  }
 
  int status;
  checked("wait", wait(&status));
  assert(WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP);
    // No way to know whether this SIGTRAP was caused by entry/exit, because we couldn't set PTRACE_O_TRACESYSGOOD until now (see ptracetest2.c).
 
  printf("opaque trap passed\n");
 
  checked("ptrace", ptrace(PTRACE_SETOPTIONS, child, NULL, PTRACE_O_TRACESYSGOOD));
 
  long orig_eax;
 
  for(;;)
  {
    checked("ptrace", ptrace(PTRACE_SYSCALL, child, NULL, NULL));
 
    checked("wait", wait(&status));
 
    if (WIFEXITED(status)) break;
 
    if (WSTOPSIG(status) == (SIGTRAP | 0x80))
    {
      orig_eax = ptrace(PTRACE_PEEKUSER, child, SYSCALL_OFF, NULL);
      if(orig_eax == SYS_open){
          ptrace(PTRACE_GETREGS, child, NULL, &regs);
            printf("syscall_%3d\n", regs.orig_rax);
            switch(regs.orig_rax){
                case __NR_open:
                  printf("open %s \n", (char *)regs.rbx);
                  break;
                case __NR_exit:
                  goto exit;
                  break;
                default:
                  printf("%#08x, %#08x, %#08x\n",regs.rbx, regs.rcx, regs.rdx);
                  break;
            }
 
      }
    }
    else
    {
      assert(WSTOPSIG(status) == SIGTRAP);
      printf("non-syscall trap\n");
    }
  }
  exit:
  return 0;
}