Use ptrace to obtain machine instructions <p>I wrote a simple program to get instructions of a process using ptrace. You can find the code here</p> <p><a href="http://pastebin.com/yHbkc0Je" rel="nofollow">http://pastebin.com/yHbkc0Je</a></p> <p>I compiled and ran it in under Ubuntu 64bit.</p> <p>What I got is something like this:</p> <pre><code>EIP: 7f7e5edf5c75 Instruction executed: 8824848948f0394c EIP: 7f7e5edf5c78 Instruction executed: 8824848948 EIP: 7f7e5edf5c80 Instruction executed: 84f6000000da840f EIP: 7f7e5edf5c86 Instruction executed: 2000000b42484f6 ... ... EIP: 400dab Instruction executed: e8c78948ef458d48 EIP: 400daf Instruction executed: fffffe29e8c78948 EIP: 400db2 Instruction executed: 458d48fffffe29e8 EIP: 400be0 Instruction executed: d680020148225ff ... ... EIP: 7f7e5ee012f0 Instruction executed: 2404894838ec8348 EIP: 7f7e5ee012f4 Instruction executed: 244c894824048948 ... ... </code></pre> <p>When I used gdb, I only can see those instruction under EIP: 400dab... I can't find those under 7f... so I guess It was wrong...</p> <pre><code>(gdb) x/20xg 0x0000000000400dab 0x400dab &lt;main+135&gt;: 0xe8c78948ef458d48 0xee458d48fffffe29 0x400dbb &lt;main+151&gt;: 0xfffffe4de8c78948 0x10c0834880458b48 0x400dcb &lt;main+167&gt;: 0x48ee558d48088b48 0x8948ce8948c0458d </code></pre> <p>Can anyone explain why my code is wrong and how to print only the correct EIP and instructions ?</p>