如何在 x86-64 上使用 ptrace？

发布于 2024-12-04 19:45:39 字数 966 浏览 0 评论 0原文

我正在遵循此处的教程，并针对x86-64（基本上将 eax 替换为 rax 等）以便编译：

#include <sys/ptrace.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
#include <sys/user.h>
#include <sys/reg.h>
#include <unistd.h>


int main()
{   pid_t child;
    long orig_eax;
    child = fork();
    if(child == 0) {
        ptrace(PTRACE_TRACEME, 0, NULL, NULL);
        execl("/bin/ls", "ls", NULL);
    }
    else {
        wait(NULL);
        orig_eax = ptrace(PTRACE_PEEKUSER,
                          child, 4 * ORIG_RAX,
                          NULL);
        printf("The child made a "
               "system call %ld\n", orig_eax);
        ptrace(PTRACE_CONT, child, NULL, NULL);
    }
    return 0;
}

但它实际上并没有按预期工作，它总是说：

The child made a system call -1

代码中有什么问题？

原文

I'm following the tutorial here, and modified a little for x86-64(basically replace eax to rax,etc) so that it compiles:

#include <sys/ptrace.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
#include <sys/user.h>
#include <sys/reg.h>
#include <unistd.h>


int main()
{   pid_t child;
    long orig_eax;
    child = fork();
    if(child == 0) {
        ptrace(PTRACE_TRACEME, 0, NULL, NULL);
        execl("/bin/ls", "ls", NULL);
    }
    else {
        wait(NULL);
        orig_eax = ptrace(PTRACE_PEEKUSER,
                          child, 4 * ORIG_RAX,
                          NULL);
        printf("The child made a "
               "system call %ld\n", orig_eax);
        ptrace(PTRACE_CONT, child, NULL, NULL);
    }
    return 0;
}

But it doesn't actually work as expected, it always says:

The child made a system call -1

What's wrong in the code?

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

戒ㄋ 2024-12-11 19:45:39

ptrace 返回 -1 并带有 errno EIO，因为您尝试读取的内容未正确对齐。摘自 ptrace 联机帮助页：

<前><代码> PTRACE_PEEKUSER
读取子进程 USER 区域中偏移地址 addr 处的一个字，其中
保存寄存器和有关进程的其他信息（参见
）。该单词作为结果返回
ptrace() 调用。通常偏移量必须是字对齐的，
尽管这可能因架构而异。参见注释。（数据是
忽略。）

在我的 64 位系统中，4 * ORIG_RAX 不是 8 字节对齐的。尝试使用 0 或 8 等值，它应该可以工作。

ptrace returns -1 with errno EIO because what you're trying to read is not correctly aligned. Taken from ptrace manpage:

   PTRACE_PEEKUSER
          Reads a word at offset addr in  the  child's  USER  area,  which
          holds the registers and other information about the process (see
          <sys/user.h>).  The word  is  returned  as  the  result  of  the
          ptrace()  call.   Typically  the  offset  must  be word-aligned,
          though this might vary by architecture.  See  NOTES.   (data  is
          ignored.)

In my 64-bits system, 4 * ORIG_RAX is not 8-byte-aligned. Try with values such 0 or 8 and it should work.

回复收藏 0 原文