-1

Why I get this error when I use ptrace PTRACE_PEEKTEXT in my C program??

the part of program that I use PTRACE_PEEKTEXT in it is:

static void read_file(pid_t child, char *file)
{
    char *child_addr;
    int i;

    child_addr = (char *) ptrace(PTRACE_PEEKUSER, child, sizeof(long)*RDI, 0);

    do {
        long val;
        char *p;

        val = ptrace(PTRACE_PEEKDATA, child, child_addr, NULL);
        if (val == -1) {
            fprintf(stderr, "PTRACE_PEEKTEXT error: %s", strerror(errno));
            exit(1);
        }
        child_addr += sizeof (long);

        p = (char *) &val;
        for (i = 0; i < sizeof (long); ++i, ++file) {
            *file = *p++;
            if (*file == '\0') break;
        }
    } while (i == sizeof (long));
}

(it is part of this program)

Why does this error occur ??

PTRACE_PEEKTEXT error: Input/output error[1]

1 Answer 1

0

According to the man page, EIO means:

is invalid, or an attempt was made to read from or write to an invalid area in the tracer's or the tracee's memory, or there was a word-alignment violation, or an invalid signal was specified during a restart request.

So the child_addr variable passed to ptrace(PTRACE_PEEKDATA, ...) is likely incorrect. A good start would be to check the result of ptrace(PTRACE_PEEKUSER, ...) for errors.

2
  • the peek_user is getting me syscall number like 1 for write, but when I try to get its arguments I get this error. May 17, 2021 at 12:59
  • oh, I found the problem. I called ptrace for PEEK_USER twice continuously. first for syscall num and last for argument and I think it is incorrect. but how can I get the whole of the data at once?? May 17, 2021 at 13:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .