I'm wondering if there's a way to start process suspended?
Similar to CreateProcess + CREATE_SUSPENDED in windows:
CreateProcessA(
NULL,
CmdLine,
NULL,
NULL,
FALSE,
CREATE_SUSPENDED,
NULL,
"C:\\Windows\\System32\\",
&si,
&pi);
ptrace seems to support PTRACE_ATTACH only, there's no way to start a process and suspend it directly, any ideas?
EDIT
I need to be able to catch process like this,
int main()
{
exit(0);
}
So the shell approach will not work, as the process quits really fast.