I've found issue, that fake_execve() called before trace process (child) ready. It is not important in common use, because fake_execve() just print pretty formatted line (with argc, argv[] and environ). But if we pass "-i" arg to strace, fake_execve() -> printleader() -> if(iflag) ->printcall() try to determine "Instruction Pointer" by calling upeek() -> ptrace(PTRACE_PEEKUSER, ...). And very often (on fast CPU) ptrace() fail in case that trace process (child) not ready for it, BUT if runs, it produces wrong Inst. Pointer address. Reproducible: Sometimes Steps to Reproduce: $ strace -i cat /dev/null upeek: ptrace(PTRACE_PEEKUSER,13426,48,0): No such process [????????] execve("/bin/cat", ["cat", "/dev/null"], [/* 37 vars */]) = 0 ...
Created attachment 44376 [details, diff] fix
Comment on attachment 44376 [details, diff] fix My solution is remove fake_execve() function call and insert kill(getpid(), SIGSTOP) function before execve(TARGET_BIN,....).
they've applied a fix in 4.5.10 upstream ... please re-open if 4.5.11 doesnt work properly still
