PTRACE_SYSCALL analysis

[Piotr Szerman]

Hello. I'm writing to ask how strace is able to distinguish a syscall entry from a syscall exit with ptrace(PTRACE_SYSCALL...)? On x86_64, it seems you can rely on the -ENOSYS value in RAX. However, for some reason I can't pick up an analogous coherent pattern on ARM. I'd be deeply indebted for sheding some light on the issue.

Best regards
Piotr

-- IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium.  Thank you.

ARM Limited, Registered office 110 Fulbourn Road, Cambridge CB1 9NJ, Registered in England & Wales, Company No:  2557590
ARM Holdings plc, Registered office 110 Fulbourn Road, Cambridge CB1 9NJ, Registered in England & Wales, Company No:  2548782