Mailing Lists: Apple Mailing Lists
Image of Mac OS face in stamp
Re: Am I being debugged?
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Am I being debugged?

Justin is right, ptrace isn't going to help you out here.

It is possible to find out if you are being traced, however. Or at least "ps" can do it (it puts an X in the process status field for traced processes...). This doesn't 100% guarantee you are running under gdb, but there aren't that many other tools out there that use ptrace, so it's a pretty good bet...

If you grub around a bit in the ps source code, you find that they get the information you want from one of the kinfo_proc fields returned by sysctl. Note that all the interfaces to do this are marked in the header files with "#ifdef __APPLE_API_UNSTABLE" so this isn't guaranteed to work anywhere else, but on Panther, something like:

#include <sys/sysctl.h>
#include <unistd.h>

#include <err.h>
#include <errno.h>
#include <stdio.h>

int main ()

  int mib[4];
  size_t bufSize = 0;
  int local_error = 0;
  struct kinfo_proc kp;

  mib[0] = CTL_KERN;
  mib[1] = KERN_PROC;
  mib[2] = KERN_PROC_PID;
  mib[3] = getpid();

  bufSize = sizeof (kp);
  if ((local_error = sysctl(mib, 4, &kp, &bufSize, NULL, 0)) < 0) {
    perror("Failure calling sysctl");
    return 0;
  if (kp.kp_proc.p_flag & P_TRACED)
    printf ("I am traced\n");
    printf ("I am not traced\n");
  return 0;

will do what you want. To detect if you have been attached to, you are just going to have to run this periodically and check whether you have become traced. There isn't any message that you are sent, at least none that I know of, on ptrace attach.


On Feb 17, 2004, at 9:11 AM, Justin Walker wrote:

On Tuesday, February 17, 2004, at 02:26 AM, Matt Gough wrote:

In my Development build, I would like to be able to determine (at runtime)
whether I am running inside gdb, or just running normally. What is the best
way to do this?

Also, could I determine if I started normally, but have been attached to

The only way I know of to see that you are running inside gdb is to find your parent process's PID, and figure out whether that is 'gdb'. This doesn't tell you whether you are being bugged; just that you are being bugged by 'gdb' (the admittedly pedantic point being that there may be other debuggers out there...)

I know of no way to determine that 'gdb' has attached to your process.

There may be something Mach-like that will give you some or all of this information, but I'm not aware of anything specific.



Justin C. Walker, Curmudgeon-At-Large *
Institute for General Semantics | It's not whether you win or lose...
| It's whether *I* win or lose.
*-------------------------------------- *-------------------------------*
xcode-users mailing list | email@hidden
Do not post admin requests to the list. They will be ignored.

Jim Ingham                                   email@hidden
Developer Tools
Apple Computer
xcode-users mailing list | email@hidden
Do not post admin requests to the list. They will be ignored.

 >Re: Am I being debugged? (From: Justin Walker <email@hidden>)

Visit the Apple Store online or at retail locations.

Contact Apple | Terms of Use | Privacy Policy

Copyright © 2011 Apple Inc. All rights reserved.