I'm working on a tool that sometimes hijacks application execution, including working in a different stack.
I'm trying to get the kernel to always see the application stack when performing certain system calls, so that it will print the [stack] qualifier in the right place in /proc/pid/maps.
However, simply modifying the esp around the system call seems not to be enough. When I use my tool on "cat /proc/self/stat" I'm seeing kstkesp (entry 29 here) sometimes has the value I want but sometimes has a different value, corresponding to my alternate stack.
I'm trying to understand:
- How is the value reflected in /proc/self/stat:29 determined?
- Can I modify it so that it will reliably have an appropriate value?
- If 2 is difficult to answer, where would you recommend that I look to understand why the value is intermittently incorrect?