Get instruction pointer of running application on Unix

Question

Is there a way to get the instruction pointer of a running application Unix?

I have a running process (C++) and want to get its current location, and thereafter in GDB (on a different machine) map the location to source location ('list' command).

Answer 1

If you're using gdb anyway, you can simply attach yourself to a running process like this:

gdb program 1234

where program is the name of the executable you're debugging, and 1234 is the PID. You can then use all of the facilities of gdb to debug the process.

Answer 2

You will need to temporarily stop the process or thread in order to get its current instruction pointer. You can do it by attaching to the process with ptrace() or (on HP-UX) ttrace() and accessing the registers.

Answer 3

On Linux, there is /proc/[pid]/stat. From "man proc":

 stat   Status information about the process. This is used by
       ps(1). It is defined in /usr/src/linux/fs/proc/array.c.
       ...
       kstkeip %lu
       The current EIP (instruction pointer).

AFAICT, the 29th field of the output corresponds to the current instruction pointer of the process. For example:

gdb date
GNU gdb Red Hat Linux (6.0post-0.20040223.20rh)
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu"...(no debugging symbols found)...Using host libthread_db library "/lib64/tls/libthread_db.so.1".

(gdb) set stop-on-solib-events 1
(gdb) run
(no debugging symbols found)...(no debugging symbols found)...(no debugging symbols found)...[Thread debugging using libthread_db enabled]
[New Thread 182896391360 (LWP 27968)]
(no debugging symbols found)...Stopped due to shared library event
(gdb) c
[Switching to Thread 182896391360 (LWP 27968)]
Stopped due to shared library event
(gdb) where
#0  0x00000036b060bb20 in _dl_debug_state_internal () from /lib64/ld-linux-x86-64.so.2
#1  0x00000036b060b51c in _dl_init_internal () from /lib64/ld-linux-x86-64.so.2
#2  0x00000036b0600f72 in _dl_start_user () from /lib64/ld-linux-x86-64.so.2
#3  0x0000000000000001 in ?? ()
#4  0x0000007fbff62728 in ?? ()
#5  0x0000000000000000 in ?? ()
(gdb) shell cat /proc/27968/stat
27968 (date) T 27839 27968 8955 34817 27839 4194304 42 0 330 0 0 0 0 0 18 0 0 0 1881668573 6144000 78 18446744073709551615 4194304 4234416 548680739552 18446744073709551615 234887363360 0 0 0 0 18446744071563322838 0 0 17 0 0 0 0 0 0 0
(gdb) p/a 234887363360  <--- the value of 29th field
$1 = 0x36b060bb20 <_dl_debug_state_internal>

Answer 4

The instruction pointer can be retrieved on Linux with the following code:

pid_t traced_process;
struct user_regs_struct regs;

ptrace(PTRACE_ATTACH, traced_process, NULL, NULL);
ptrace(PTRACE_GETREGS, traced_process, NULL, &regs);

printf("EIP: %lx\n", regs.eip);