some code to single step after hitting utmpname int single_step_count = 1280; //dbgSTEPCOUNT; if(single_stepping){ if( single_step_count-- == 0){ single_stepping = 0; printf("COUNT OVER\n"); } } ... if(single_step_count>0 && lastfunc){ if(! strcmp(lastfunc,"utmpname") ) single_stepping = 1; else single_stepping = 0; } ... if(ret != 0 && next_eip && entered_main && !single_stepping ) { set_hook(pid, next_eip); run_hook(pid); } Hi! Alright, so single stepping 1279 times allows PTRACE_CONT to work just fine. 1278 would be the "xor %eax, %eax" you see below, single stepping up to this point and then doing a PTRACE_CONT never lets our hook catch. single stepping 1279, 1280, 1281, ... times works fine. This number (1279) varies from machine to machine. I need some help. What's going on @ that ret? b7e60692: jnz 0xb7e60688. eax=08049d00 ebx=b7f2fff4 ecx=08049dfc edx=b7f182b0 esi=0000000f edi=00000001 ebp=bfe77708 esp=bfe776e8 flags= [c] [P] [a] [Z] [s] [t] [I] [df] [id] 246 stack: b7ef6c06 08049dee b7f182a2 b7f77300 b7e60694: xor %eax,%eax. eax=00000000 ebx=b7f2fff4 ecx=08049dfc edx=b7f182b0 esi=0000000f edi=00000001 ebp=bfe77708 esp=bfe776e8 flags= [c] [P] [a] [Z] [s] [t] [I] [df] [id] 246 stack: b7ef6c06 08049dee b7f182a2 b7f77300 b7e60696: ret . <------- ??? LOL ??? eax=00000000 ebx=b7f2fff4 ecx=08049dfc edx=b7f182b0 | esi=0000000f edi=00000001 ebp=bfe77708 esp=bfe776ec | flags= [c] [P] [a] [Z] [s] [t] [I] [df] [id] 246 | stack: 08049dee b7f182a2 b7f77300 b7f182a2 | | b7ef6c06: xor %edx,%edx. <---------/ COUNT OVER eax=00000000 ebx=00000000 ecx=08049dfc edx=00000000 esi=0000000f edi=00000001 ebp=00000001 esp=bfe77710 flags= [c] [P] [a] [Z] [s] [t] [I] [df] [id] 246 stack: 08049dee 00005413 bfe77730 080488d9 804970d: call 0x8048aac ### setutent(). eax=00000000 ebx=00000000 ecx=08049dfc edx=00000000 esi=0000000f edi=00000001 ebp=00000001 esp=bfe7770c flags= [c] [P] [a] [Z] [s] [t] [I] [df] [id] 246 stack: 08049712 08049dee 00005413 bfe77730 updated to show the first 4 instr bytes b7e9f694> 31 c0 c3 b8 b7e9f694: xor %eax,%eax. eax=00000000 ebx=b7f6eff4 ecx=08049dfc edx=b7f572b0 esi=0000000f edi=00000001 ebp=bfc3ccc8 esp=bfc3cca8 flags= [c] [P] [a] [Z] [s] [t] [I] [df] [id] 246 stack: bfc3ccc8 b7f35c06 08049dee b7f572a2 b7e9f696> c3 b8 01 00 b7e9f696: ret . eax=00000000 ebx=b7f6eff4 ecx=08049dfc edx=b7f572b0 esi=0000000f edi=00000001 ebp=bfc3ccc8 esp=bfc3ccac flags= [c] [P] [a] [Z] [s] [t] [I] [df] [id] 246 stack: b7f35c06 08049dee b7f572a2 b7fb6300 b7f35c06> 31 d2 85 c0 b7f35c06: xor %edx,%edx. COUNT OVER eax=00000000 ebx=00000000 ecx=08049dfc edx=00000000 esi=0000000f edi=00000001 ebp=00000001 esp=bfc3ccd0 flags= [c] [P] [a] [Z] [s] [t] [I] [df] [id] 246 stack: 0804970d 08049dee 00005413 bfc3ccf0