ancat

import ctypes, sys, os, string

try:
    pid = int(sys.argv[1])
except IndexError:
    print >> sys.stderr, "{} <process_id>".format(sys.argv[0])
    sys.exit(1)

libc = ctypes.CDLL('/lib/x86_64-linux-gnu/libc.so.6')
libc.process_vm_readv.argtypes = [ctypes.c_uint64, ctypes.c_void_p, ctypes.c_uint64, ctypes.c_void_p, ctypes.c_uint64, ctypes.c_uint64]

ancat

/*
Question: how hook into the creation of new processes /and/ threads?

Attempt #1: Attach a kprobe to the `execve` syscall
- This works, but will not catch threads created via clone.

Attempt #2: Add an additional kretprobe to the `clone` syscall
- On success, clone returns the newly created thread id. This works fine
  until you start dealing with pid namespaces. If clone is called from a
  different pid namespace, the return value will only be valid for that