Kernel-side: ptrace

• works by *reparenting* the target process to the tracing process

• have to stop all the threads in the process and get all their statuses

• uses the single-threading routines, but with a different 'reason' flag

• still not entirely correct: MT processes stopped by a breakpoint take

  one ptrace(PT_CONTINUE) per thread to resume