I'm following the tutorial here, and modified a little for x86-64
(basically replace eax to rax,etc) so that it compiles:
我在这里跟随教程,并对x86-64进行了一些修改(基本上是将eax替换为rax,等等),以便编译:
#include <sys/ptrace.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
#include <sys/user.h>
#include <sys/reg.h>
#include <unistd.h>
int main()
{ pid_t child;
long orig_eax;
child = fork();
if(child == 0) {
ptrace(PTRACE_TRACEME, 0, NULL, NULL);
execl("/bin/ls", "ls", NULL);
}
else {
wait(NULL);
orig_eax = ptrace(PTRACE_PEEKUSER,
child, 4 * ORIG_RAX,
NULL);
printf("The child made a "
"system call %ld\n", orig_eax);
ptrace(PTRACE_CONT, child, NULL, NULL);
}
return 0;
}
But it doesn't actually work as expected, it always says:
但实际上它并没有像预期的那样工作,它总是说:
The child made a system call -1
What's wrong in the code?
代码有什么问题?
2 个解决方案
#1
6
ptrace returns -1 with errno EIO because what you're trying to read is not correctly aligned. Taken from ptrace manpage:
ptrace返回-1并返回errno EIO,因为您试图读取的内容没有正确对齐。来自:ptrace联机帮助页
PTRACE_PEEKUSER Reads a word at offset addr in the child's USER area, which holds the registers and other information about the process (see <sys/user.h>). The word is returned as the result of the ptrace() call. Typically the offset must be word-aligned, though this might vary by architecture. See NOTES. (data is ignored.)
In my 64-bits system, 4 * ORIG_RAX is not 8-byte-aligned. Try with values such 0 or 8 and it should work.
在我的64位系统中,4 * ORIG_RAX不是8字节对齐的。尝试用0或8这样的值,它应该可以工作。
#2
6
In 64 bit = 8 * ORIG_RAX
在64位中= 8 * ORIG_RAX
8 = sizeof(long)
8 = sizeof(长)
#1
6
ptrace returns -1 with errno EIO because what you're trying to read is not correctly aligned. Taken from ptrace manpage:
ptrace返回-1并返回errno EIO,因为您试图读取的内容没有正确对齐。来自:ptrace联机帮助页
PTRACE_PEEKUSER Reads a word at offset addr in the child's USER area, which holds the registers and other information about the process (see <sys/user.h>). The word is returned as the result of the ptrace() call. Typically the offset must be word-aligned, though this might vary by architecture. See NOTES. (data is ignored.)
In my 64-bits system, 4 * ORIG_RAX is not 8-byte-aligned. Try with values such 0 or 8 and it should work.
在我的64位系统中,4 * ORIG_RAX不是8字节对齐的。尝试用0或8这样的值,它应该可以工作。
#2
6
In 64 bit = 8 * ORIG_RAX
在64位中= 8 * ORIG_RAX
8 = sizeof(long)
8 = sizeof(长)