title: After attaching to process, how to check whether the tracee is in a syscall?
body: <p>According to <a href="http://man7.org/linux/man-pages/man2/ptrace.2.html" rel="noreferrer">the ptrace manual page</a>:</p>
  
  <blockquote>
    <p>Syscall-enter-stop and syscall-exit-stop are indistinguishable from
    each other by the tracer.  The tracer needs to keep track of the
    sequence of ptrace-stops in order to not misinterpret syscall-enter-
    stop as syscall-exit-stop or vice versa.</p>
  </blockquote>
  
  <p>When I attach to a process using <code>PTRACE_ATTACH</code>, how do I know whether the tracee is currently in a syscall or not? Put differently, if I restart the tracee using <code>PTRACE_SYSCALL</code>, how do I know whether the next syscall-stop is a <code>syscall-enter-stop</code> or a <code>syscall-exit-stop</code>?</p>