some code to single step after hitting utmpname
 
    int single_step_count = 1280; //dbgSTEPCOUNT;
 
        if(single_stepping){
            if( single_step_count-- == 0){
                single_stepping = 0;
                printf("COUNT OVER\n");
            }
        }
...
        if(single_step_count>0 && lastfunc){
            if(! strcmp(lastfunc,"utmpname") )
                single_stepping = 1;
            else
                single_stepping = 0;
        }
 
...
 
        if(ret != 0 && next_eip && entered_main && !single_stepping )
        {
                set_hook(pid, next_eip);
                run_hook(pid);
        }
 
Hi! Alright, so single stepping 1279 times allows PTRACE_CONT to work just fine. 
1278 would be the "xor %eax, %eax" you see below, single stepping up to this point 
and then doing a PTRACE_CONT never lets our hook catch.
single stepping 1279, 1280, 1281, ... times works fine. This number (1279)
varies from machine to machine.
 
I need some help. What's going on @ that ret?

also, note that im getting the stack offset by -4 
    stack[0] = ptrace(PTRACE_PEEKTEXT, pid, regs.esp-4, 0);
    stack[1] = ptrace(PTRACE_PEEKTEXT, pid, regs.esp, 0);
    stack[2] = ptrace(PTRACE_PEEKTEXT, pid, regs.esp+4, 0);
    stack[3] = ptrace(PTRACE_PEEKTEXT, pid, regs.esp+8, 0);

 

b7e21692: jnz 0xb7e21688.
  eax=08049d00 ebx=b7ef0ff4 ecx=08049dfc edx=b7ed92b0 
  esi=0000000f edi=00000001 ebp=bf8580e8 esp=bf8580c8 
  flags= [c] [P] [a] [Z] [s] [t] [I] [df] [id] 246
  stack:  bf8580e8 b7eb7c06 08049dee b7ed92a2

b7e21694> 31 c0 c3 b8 01 00 00 00
b7e21694: xor %eax,%eax.
  eax=00000000 ebx=b7ef0ff4 ecx=08049dfc edx=b7ed92b0 
  esi=0000000f edi=00000001 ebp=bf8580e8 esp=bf8580c8 
  flags= [c] [P] [a] [Z] [s] [t] [I] [df] [id] 246
  stack:  bf8580e8 b7eb7c06 08049dee b7ed92a2

b7e21696> c3 b8 01 00 00 00 b9 ff
b7e21696: ret .
  eax=00000000 ebx=b7ef0ff4 ecx=08049dfc edx=b7ed92b0 
  esi=0000000f edi=00000001 ebp=bf8580e8 esp=bf8580cc 
  flags= [c] [P] [a] [Z] [s] [t] [I] [df] [id] 246
  stack:  b7eb7c06 08049dee b7ed92a2 b7f38300

b7eb7c06> 31 d2 85 c0 75 27 65 83
b7eb7c06: xor %edx,%edx.
COUNT OVER
  eax=00000000 ebx=00000000 ecx=08049dfc edx=00000000 
  esi=0000000f edi=00000001 ebp=00000001 esp=bf8580f0 
  flags= [c] [P] [a] [Z] [s] [t] [I] [df] [id] 246
  stack:  0804970d 08049dee 00005413 bf858110

804970d> e8 9a f3 ff ff 8b 5c 24
804970d: call 0x8048aac         ###     setutent().
  eax=00000000 ebx=00000000 ecx=08049dfc edx=00000000 
  esi=0000000f edi=00000001 ebp=00000001 esp=bf8580ec 
  flags= [c] [P] [a] [Z] [s] [t] [I] [df] [id] 246
  stack:  00000001 08049712 08049dee 00005413






about ebp:

8049708> e8 6f f3 ff ff e8 9a f3
8049708: call 0x8048a7c         ###     utmpname().
  eax=00000023 ebx=00000000 ecx=00000023 edx=b7ef20b0 
  esi=0000000f edi=00000001 ebp=00000001 esp=bfb7ec0c 
  flags= [c] [P] [a] [Z] [s] [t] [I] [df] [id] 246
  stack:  00000001 0804970d 08049dee 00005413







and some output from w.procps compiled from src
b7ed6694> 31 c0 c3 b8 01 00 00 00
b7ed6694: xor %eax,%eax.
  eax=00000000 ebx=b7fa5ff4 ecx=08049d17 edx=b7f8e2b0 
  esi=0000001f edi=00000000 ebp=bf9929d8 esp=bf9929b8 
  flags= [c] [P] [a] [Z] [s] [t] [I] [df] [id] 246
  stack:  bf9929d8 b7f6cc06 08049d09 b7f8e2a2

b7ed6696> c3 b8 01 00 00 00 b9 ff
b7ed6696: ret .
  eax=00000000 ebx=b7fa5ff4 ecx=08049d17 edx=b7f8e2b0 
  esi=0000001f edi=00000000 ebp=bf9929d8 esp=bf9929bc 
  flags= [c] [P] [a] [Z] [s] [t] [I] [df] [id] 246
  stack:  b7f6cc06 08049d09 b7f8e2a2 b7fed300

b7f6cc06> 31 d2 85 c0 75 27 65 83
b7f6cc06: xor %edx,%edx.
COUNT OVER
  eax=00000000 ebx=00000001 ecx=08049d17 edx=00000000 
  esi=0000001f edi=00000000 ebp=bf992a18 esp=bf9929e0 
  flags= [c] [P] [a] [Z] [s] [t] [I] [df] [id] 246
  stack:  08049653 08049d09 00005413 bf992a00

8049653> e8 90 f3 ff ff 8b 45 d4
8049653: call 0x80489e8         ###     setutent().
  eax=00000000 ebx=00000001 ecx=08049d17 edx=00000000 
  esi=0000001f edi=00000000 ebp=bf992a18 esp=bf9929dc 
  flags= [c] [P] [a] [Z] [s] [t] [I] [df] [id] 246
  stack:  bf992a18 08049658 08049d09 00005413