some syscalls have arguments that are read/write. for example, getsockopt passes in a pointer to a length that has to be set correctly first, and then the kernel will adjust it when returning. being able to see both values is important when getting an error so you can see what the user sent up and what the kernel sent back.
are there examples in strace to look at ? perhaps something like: getsockopt(4, SOL_IP, IPT_SO_GET_ENTRIES, "...", [2900->2804]) = 0 and when you get an error it'd be: getsockopt(4, SOL_IP, IPT_SO_GET_ENTRIES, 0x12345, [2900->2900]) = EINVAL -mike
signature.asc
Description: Digital signature
------------------------------------------------------------------------------
_______________________________________________ Strace-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/strace-devel
