title: ptrace get changed memory by syscall
body: <p>ptrace can get the registers and memory data when entry/exit syscall. But if linux syscall handler change some memory include some place in stack, How can I get to know which memory has been changed. </p>