title: Get the return value with ptrace using SINGLESTEP
body: <p>I'm working on a little debugger under Linux 64bits and I'm having trouble looking for syscall's return value,</p>
  
  <p>I'm testing RIP value, I mean I do a PEEK_USERDATA and ptrace give me the opcode in return no the RIP address, directly this way (where 0x050f is the opcode of SYSCALL):</p>
  
  <pre><code>if (rip &amp; 0x0000ffff == 0x050f)
  </code></pre>
  
  <p>then get syscall name args etc</p>
  
  <p>The problem is how do I get the return value of these syscalls, and I know ptrace provide PTRACE_SYSCALL to warn us about enterring/leaving kernel-mode but I'd like to check directly the RIP value so I'm using SINGLESTEP, I checked if my rip match the SYSLEAVE and SYSEXIT opcode but it never. The only way I can check the return value is actually by checking my orig_rax but I won't get the exit_group retval this way.</p>
  
  <p>I know that the Linux ABI want the return value to be stored in RAX, but I don't how to witness a return to userland.</p>
  
  <p>Thanks you.</p>