title: How does strace read the file name of system call sys_open?
body: <p>I am writing a program which uses Ptrace and does the following:</p>
  
  <ul>
  <li>It reads the current eax and checks if the system call is sys_open.</li>
  <li>If it is then i need to know what are the arguments that are passed.
  
  <blockquote>
    <p>int sys_open(const char * filename, const int mode, const int mask)</p>
  </blockquote></li>
  </ul>
  
  <p>So eax = 5 implies it is a open system call<br>
  I came to know ebx has the address of the file location from this <a href="https://stackoverflow.com/questions/9769350/system-call-tracing-using-ptrace">Question</a>
  But how do I knows the length of the file name so I can read the contents in that location?<br>
  I came across the following questions which address the same <br>
  <a href="https://stackoverflow.com/questions/5489306/ptrace-edx-for-sys-open-inconsistent">Question 1</a> <br>
  <a href="https://stackoverflow.com/questions/9786648/using-ptrace-to-track-the-location-of-files-being-opened">Question 2</a> (This one is mine only!)<br>
  But I still didn't get a solution to my problem. :( as both the answers were not clear. 
  I am still getting a segmentation fault when I try the approach in the Question-1<br>
  You can check my code <a href="http://pastie.org/3639720" rel="nofollow noreferrer">here</a><br>
  So Now I really was wondering how does strace extract these values so beautifully :(</p>