How does strace connect to an already running process?

Question

I do know that strace uses ptrace to do the job,

but it needs to run the target process with TRACE_ME on,

which don\'t app

Answer 1

The details of ptrace() are OS-specific.

On Linux, a child may request to be traced by its parent with ptrace(PTRACE_TRACEME, ...); but, alternatively, a process may attach itself to another process with ptrace(PTRACE_ATTACH, ...).

See the Linux ptrace(2) man page (and, if you really want the fine details, the strace source, and kernel source starting at kernel/ptrace.c).