Hi Jasen! :-)

 JB> no, that won't work for data breakpoint set for read operations...
 JB> you need to interpret the op-codes to see which addresses they are 
 JB> referencing.
Yeah, that can be hard work.

 JB> break is int3 iirc. (iAPX86 op-code "0xCC")
Could well be.

[ptrace]
 JB> That may use the single-step flag...
Well, it works on more than one architecture, but on x86 I suppose that will be true.

Looking at gdb, it uses the 386 and above debug registers to implement data
breakpoints, so those are available outside the kernel and the kernel takes
care in preserving them when switching tasks (otherwise you could try to
pry on another task's memory).

Ciao
Pascal

--- Msged/LNX 6.1.1