Example not working on Debian sid

[manuels]

I just want to leave a note that the example with cat TWO.txt does not work on a recent Debian sid.
The reason is, that cat now uses the openat() syscall instead of open().
Anyway, great code project! Thanks @alfonsosanchezbeato!

[hanwen]

when adapting for openat(), you have to get the 2nd argument to the syscall (from RSI), rather than the 1st.

Alternatively,

  struct ptrace_syscall_info info =  {};
  int err = ptrace(PTRACE_GET_SYSCALL_INFO, child, sizeof(info),  &info);

will work on recent linux kernels and is architecture independent.