static void handle_syscall_return(pid_t pid, struct traced_child *kid) { int syscall; struct user_regs_struct u_in; ptrace(PTRACE_GETREGS, pid, 0, &u_in); syscall = u_in.orig_eax; if (syscall == 0xbadca11) { ptrace(PTRACE_POKEUSER, pid, 44, kid->orig_eax); //restore the syscall if( kid->ret < 0 ) ptrace(PTRACE_POKEUSER, pid, 24, -13); //EACCES error else ptrace(PTRACE_POKEUSER, pid, 24, 0); //even if 0 is changed to -13, I still get same output! } ptrace(PTRACE_SYSCALL, pid, 0, 0); }