This blog is the notes during I learning the “Playing with ptrace”(http://www.linuxjournal.com/article/6100).
The original examples was using 32 bits machine, which doesn’t work on my 64 bits Ubuntu 12.10.
Let’s start from the first ptrace example:
#include <sys/ptrace.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
#include <linux/user.h>   /* For constants
                                   ORIG_EAX etc */
int main()
{   pid_t child;
    long orig_eax;
    child = fork();
    if(child == 0) {
        ptrace(PTRACE_TRACEME, 0, NULL, NULL);
        execl("/bin/ls", "ls", NULL);
    }
    else {
        wait(NULL);
        orig_eax = ptrace(PTRACE_PEEKUSER,
                          child, 4 * ORIG_EAX,
                          NULL);
        printf("The child made a "
               "system call %ldn", orig_eax);
        ptrace(PTRACE_CONT, child, NULL, NULL);
    }
    return 0;
}
The compiler shows the following error:
fatal error: 'linux/user.h' file not found
#include <linux/user.h>
Something need to change because of:
- The ‘linux/user.h’ no longer exists
- The 64 bits register is R*X, so EAX changed to RAX
There are two solutions to fix this: Continue reading “Notes for playing with ptrace on 64 bits Ubuntu 12.10”