How can I insert int3 with ptrace in Ubuntu x64?

Question

I'm trying to follow this guide to achieve the same results with setting breakpoints, the only difference is I'm on x64 system. So, I have this code for "Hello, World!":

; The _start symbol must be declared for the linker (ld)
global _start

section    .text
_start:

    ; Prepare arguments for the sys_write system call:
    ;   - rax: system call number (sys_write)
    ;   - rdi: file descriptor (stdout)
    ;   - rsi: pointer to string
    ;   - rdx: string length
    mov    rax, 1
    mov    rdi, 1
    mov    rsi, msg1
    mov    rdx, len1
    syscall

    ; int3 should be here

    mov    rax, 1
    mov    rdi, 1
    mov    rsi, msg2
    mov    rdx, len2
    syscall

    ; Execute sys_exit
    mov    rax, 60
    mov    rdi, 0
    syscall

section   .data
    msg1 db    'Hello, ', 0xa
    len1 equ    $ - msg1
    msg2 db    'world!', 0xa
    len2 equ    $ - msg2

This code is compiled like this:nasm -f elf64 hello.s && ld -s -o hello hello.o:

~$ objdump -d hello    

hello:     file format elf64-x86-64


Disassembly of section .text:

00000000004000b0 <.text>:
  4000b0:   48 b8 01 00 00 00 00    movabs $0x1,%rax
  4000b7:   00 00 00 
  4000ba:   48 bf 01 00 00 00 00    movabs $0x1,%rdi
  4000c1:   00 00 00 
  4000c4:   48 be 1c 01 60 00 00    movabs $0x60011c,%rsi
  4000cb:   00 00 00 
  4000ce:   48 ba 08 00 00 00 00    movabs $0x8,%rdx
  4000d5:   00 00 00 
  4000d8:   0f 05                   syscall 
  4000da:   48 b8 01 00 00 00 00    movabs $0x1,%rax
  4000e1:   00 00 00 
  4000e4:   48 bf 01 00 00 00 00    movabs $0x1,%rdi
  4000eb:   00 00 00 
  4000ee:   48 be 24 01 60 00 00    movabs $0x600124,%rsi
  4000f5:   00 00 00 
  4000f8:   48 ba 07 00 00 00 00    movabs $0x7,%rdx
  4000ff:   00 00 00 
  400102:   0f 05                   syscall 
  400104:   48 b8 3c 00 00 00 00    movabs $0x3c,%rax
  40010b:   00 00 00 
  40010e:   48 bf 00 00 00 00 00    movabs $0x0,%rdi
  400115:   00 00 00 
  400118:   0f 05                   syscall

After that, in a C program I'm trying to set a breakpoint, as it's described in the article.

#include <stdio.h>
#include <stdarg.h>
#include <stdlib.h>
#include <signal.h>
#include <syscall.h>
#include <sys/ptrace.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <sys/reg.h>
#include <sys/user.h>
#include <unistd.h>
#include <errno.h>


void procmsg(const char* format, ...)
{
    va_list ap;
    fprintf(stdout, "[%d] ", getpid());
    va_start(ap, format);
    vfprintf(stdout, format, ap);
    va_end(ap);
}

void run_target(const char* programname)
{
    procmsg("target started. will run '%s'\n", programname);

    /* Allow tracing of this process */
    if (ptrace(PTRACE_TRACEME, 0, 0, 0) < 0) {
        perror("ptrace");
        return;
    }

    /* Replace this process's image with the given program */
    execl(programname, programname, (char *)NULL);
}

void run_debugger(pid_t child_pid)
{
    int wait_status;
    struct user_regs_struct regs;

    procmsg("debugger started\n");

    /* Wait for child to stop on its first instruction */
    wait(&wait_status);

    /* Obtain and show child's instruction pointer */
    ptrace(PTRACE_GETREGS, child_pid, 0, &regs);
    procmsg("Child started. RIP = 0x%08x\n", regs.rip);

    unsigned addr = 0x004000da;
    unsigned data = ptrace(PTRACE_PEEKTEXT, child_pid, (void*)addr, 0);
    procmsg("Original data at 0x%08x: 0x%08x\n", addr, data);

    /* Write the trap instruction 'int 3' into the address */
    unsigned data_with_trap = (data & 0xFFFFFF00) | 0xCC;
    ptrace(PTRACE_POKETEXT, child_pid, (void*)addr, (void*)data_with_trap);

    /* See what's there again... */
    unsigned readback_data = ptrace(PTRACE_PEEKTEXT, child_pid, (void*)addr, 0);
    procmsg("After trap, data at 0x%08x: 0x%08x\n", addr, readback_data);

    /* Let the child run to the breakpoint and wait for it to
    ** reach it
    */
    ptrace(PTRACE_CONT, child_pid, 0, 0);

    wait(&wait_status);
    if (WIFSTOPPED(wait_status)) {
        procmsg("Child got a signal: %s\n", strsignal(WSTOPSIG(wait_status)));
    }
    else {
        perror("wait");
        return;
    }

    /* See where the child is now */
    ptrace(PTRACE_GETREGS, child_pid, 0, &regs);
    procmsg("Child stopped at RIP = 0x%08x\n", regs.rip);

    /* Remove the breakpoint by restoring the previous data
    ** at the target address, and unwind the EIP back by 1 to
    ** let the CPU execute the original instruction that was
    ** there.
    */
    ptrace(PTRACE_POKETEXT, child_pid, (void*)addr, (void*)data);
    regs.rip -= 1;
    ptrace(PTRACE_SETREGS, child_pid, 0, &regs);

    /* The child can continue running now */
    ptrace(PTRACE_CONT, child_pid, 0, 0);

    wait(&wait_status);

    if (WIFEXITED(wait_status)) {
        procmsg("Child exited\n");
    }
    else {
        procmsg("Unexpected signal\n");
    }
}


int main(int argc, char** argv)
{
    pid_t child_pid;

    if (argc < 2) {
        fprintf(stderr, "Expected a program name as argument\n");
        return -1;
    }

    child_pid = fork();
    if (child_pid == 0)
        run_target(argv[1]);
    else if (child_pid > 0)
        run_debugger(child_pid);
    else {
        perror("fork");
        return -1;
    }

    return 0;
}

This code also compiles, but leads to a segmentation fault during execution:

~$ ./ptrace_test_bp hello                         
[24100] debugger started
[24101] target started. will run 'hello'
[24100] Child started. RIP = 0x004000b0
[24100] Original data at 0x004000da: 0x0001b848
[24100] After trap, data at 0x004000da: 0x0001b8cc
Hello, 
[1]    24100 segmentation fault (core dumped)  ./ptrace_test_bp hello

What should I do to make it behave properly (stop on breakpoint and resume) on x64?

Answer 1

Your C code is segfaulting in strsignal because you have forgotten to #include <string.h>.

To be precise, it's segfaulting because without prototype the return value of strsignal is assumed to be an int (which is 32 bits) when it is in fact a pointer with 64 bits.

Answer 2

@Enchantner, Thank to your question. I met with similar problem recently. It inspired me a lot. After fixing the error according @Jester, there is still segment error. So I spent some time digging into it. Finally, I worked it out.

The ptrace word length for peek/poke is 64 bit, not 32, on x86-64 Linux. But the code is using unsigned (32-bit), which will cast to long type, 64-bit, in the ptrace(2) call.

For example, a POKETEXT of 0xaabbccdd will actually write 0x00000000aabbccdd to memory, assuming it happens to be zero-extended by the caller. Necessarily, it will mess up memory.

So it will work to change the type to long, which is 64-bit in the x86-64 System V ABI.

#include <stdio.h>
#include <stdarg.h>
#include <stdlib.h>
#include <signal.h>
#include <syscall.h>
#include <sys/ptrace.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <sys/reg.h>
#include <sys/user.h>
#include <unistd.h>
#include <errno.h>
#include <string.h>

void procmsg(const char* format, ...)
{
    va_list ap;
    fprintf(stdout, "[%d] ", getpid());
    va_start(ap, format);
    vfprintf(stdout, format, ap);
    va_end(ap);
}

void run_target(const char* programname)
{
    procmsg("target started. will run '%s'\n", programname);

    /* Allow tracing of this process */
    if (ptrace(PTRACE_TRACEME, 0, 0, 0) < 0) {
        perror("ptrace");
        return;
    }

    /* Replace this process's image with the given program */
    execl(programname, programname, (char *)NULL);
}

void run_debugger(pid_t child_pid)
{
    int wait_status;
    struct user_regs_struct regs;

    procmsg("debugger started\n");

    /* Wait for child to stop on its first instruction */
    wait(&wait_status);

    /* Obtain and show child's instruction pointer */
    ptrace(PTRACE_GETREGS, child_pid, 0, &regs);
    procmsg("Child started. RIP = 0x%08x\n", regs.rip);

    long addr = 0x004000cb;//0x004000da;
    long data = ptrace(PTRACE_PEEKTEXT, child_pid, (void*)addr, 0);
    procmsg("Original data at 0x%08x: 0x%08x\n", addr, data);

    /* Write the trap instruction 'int 3' into the address */
    long data_with_trap = (data & 0xFFFFFFFFFFFFFF00) | 0xCC;
    ptrace(PTRACE_POKETEXT, child_pid, (void*)addr, (void*)data_with_trap);

    /* See what's there again... */
    long readback_data = ptrace(PTRACE_PEEKTEXT, child_pid, (void*)addr, 0);
    procmsg("After trap, data at 0x%08x: 0x%08x\n", addr, readback_data);

    /* Let the child run to the breakpoint and wait for it to
    ** reach it
    */
    ptrace(PTRACE_CONT, child_pid, 0, 0);

    wait(&wait_status);
    if (WIFSTOPPED(wait_status)) {
        procmsg("Child got a signal: %s\n", strsignal(WSTOPSIG(wait_status)));
    }
    else {
        perror("wait");
        return;
    }

    /* See where the child is now */
    ptrace(PTRACE_GETREGS, child_pid, 0, &regs);
    procmsg("Child stopped at RIP = 0x%08x\n", regs.rip);

    /* Remove the breakpoint by restoring the previous data
    ** at the target address, and unwind the EIP back by 1 to
    ** let the CPU execute the original instruction that was
    ** there.
    */
    ptrace(PTRACE_POKETEXT, child_pid, (void*)addr, (void*)data);

/* See what's there again... */
     readback_data = ptrace(PTRACE_PEEKTEXT, child_pid, (void*)addr, 0);
     procmsg("After restore, data at 0x%08x: 0x%08x\n", addr, readback_data);


    regs.rip -= 1;
    ptrace(PTRACE_SETREGS, child_pid, 0, &regs);

    /* The child can continue running now */
    ptrace(PTRACE_CONT, child_pid, 0, 0);

    wait(&wait_status);
    if (WIFEXITED(wait_status)) {
        procmsg("Child exited\n");
    } else if(WIFSIGNALED(wait_status)) {
    procmsg("signal !!!\n");
    }
    else {
        procmsg("Unexpected signal. %s \n",  strsignal(WSTOPSIG(wait_status)));
    }
 } 

int main(int argc, char** argv)
{
    pid_t child_pid;

    if (argc < 2) {
        fprintf(stderr, "Expected a program name as argument\n");
        return -1;
    }

    child_pid = fork();
    if (child_pid == 0)
        run_target(argv[1]);
    else if (child_pid > 0)
        run_debugger(child_pid);
    else {
        perror("fork");
        return -1;
    }

    return 0;
}

In addition, you must modify the long addr = 0x004000cb;//0x004000da; according your compiled object file. You see it's different in my Ubuntu system with the guide.

________________divider______________________________

It's my inference above all and shows indeed that it solve the problem. But I wanna test more to confirm the conclusion. This is my test code.

the objdump -d hello2 output

hello2:     file format elf64-x86-64


Disassembly of section .text:

00000000004000b0 <.text>:
  4000b0:   b8 01 00 00 00          mov    $0x1,%eax
  4000b5:   bf 01 00 00 00          mov    $0x1,%edi
  4000ba:   48 be f4 00 60 00 00    movabs $0x6000f4,%rsi
  4000c1:   00 00 00 
  4000c4:   ba 08 00 00 00          mov    $0x8,%edx
  4000c9:   0f 05                   syscall 
  4000cb:   b8 01 00 00 00          mov    $0x1,%eax
  4000d0:   bf 01 00 00 00          mov    $0x1,%edi
  4000d5:   48 be fc 00 60 00 00    movabs $0x6000fc,%rsi
  4000dc:   00 00 00 
  4000df:   ba 07 00 00 00          mov    $0x7,%edx
  4000e4:   0f 05                   syscall 
  4000e6:   b8 3c 00 00 00          mov    $0x3c,%eax
  4000eb:   bf 00 00 00 00          mov    $0x0,%edi
  4000f0:   0f 05                   syscall 

The debugger.c content

#include <stdio.h>
#include <stdarg.h>
#include <stdlib.h>
#include <signal.h>
#include <syscall.h>
#include <sys/ptrace.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <sys/reg.h>
#include <sys/user.h>
#include <unistd.h>
#include <errno.h>
#include <string.h>

void procmsg(const char* format, ...)
{
    va_list ap;
    fprintf(stdout, "[%d] ", getpid());
    va_start(ap, format);
    vfprintf(stdout, format, ap);
    va_end(ap);
}

void run_target(const char* programname)
{
    procmsg("target started. will run '%s'\n", programname);

    /* Allow tracing of this process */
    if (ptrace(PTRACE_TRACEME, 0, 0, 0) < 0) {
        perror("ptrace");
        return;
    }

    /* Replace this process's image with the given program */
    execl(programname, programname, (char *)NULL);
}

void run_debugger(pid_t child_pid)
{
    int wait_status;
    struct user_regs_struct regs;

    procmsg("debugger started\n");

    /* Wait for child to stop on its first instruction */
    wait(&wait_status);

    /* Obtain and show child's instruction pointer */
    ptrace(PTRACE_GETREGS, child_pid, 0, &regs);
    procmsg("Child started. RIP = 0x%016x\n", regs.rip);

    long addr = 0x004000cb;//0x004000da;
    unsigned data = ptrace(PTRACE_PEEKTEXT, child_pid, (void*)addr, 0);
    procmsg("Original data at 0x%016x: 0x%016x\n", addr, data);

    //test
    unsigned data_u = data;
    procmsg("test data_u: 0x%08x\n", data_u);

    /* Write the trap instruction 'int 3' into the address */
    long data_with_trap = (data & 0xFFFFFFFFFFFFFF00) | 0xCC;
    ptrace(PTRACE_POKETEXT, child_pid, (void*)addr, (void*)data_with_trap);

    /* See what's there again... */
    long readback_data = ptrace(PTRACE_PEEKTEXT, child_pid, (void*)addr, 0);
    procmsg("After trap,set breakpoint, data at 0x%016x: 0x%016x\n", addr, readback_data);

    /* Let the child run to the breakpoint and wait for it to
    ** reach it
    */
    ptrace(PTRACE_CONT, child_pid, 0, 0);

    //wait to breakpoint
    wait(&wait_status);
    if (WIFSTOPPED(wait_status)) {
        procmsg("Child got a signal: %s\n", strsignal(WSTOPSIG(wait_status)));
    }
    else {
        perror("wait");
        return;
    }

    /* See where the child is now */
    ptrace(PTRACE_GETREGS, child_pid, 0, &regs);
    procmsg("Child stopped at RIP = 0x%016x\n", regs.rip);

    /* Remove the breakpoint by restoring the previous data
    ** at the target address, and unwind the EIP back by 1 to
    ** let the CPU execute the original instruction that was
    ** there.
    */
    int result = ptrace(PTRACE_POKETEXT, child_pid, (void*)addr, (void*)data);
    procmsg("poketext origin  back result %d\n", result);
/* See what's there again... */
     readback_data = ptrace(PTRACE_PEEKTEXT, child_pid, (void*)addr, 0);
     procmsg("After restore, data at 0x%llx: 0x%llx\n", addr, readback_data);
     int offset = 0;
     for(offset = 1; offset < 25; offset++) {
       readback_data = ptrace(PTRACE_PEEKTEXT, child_pid, (void*)(addr+offset), 0);
       procmsg("After restore, data at 0x%llx: 0x%llx\n", addr+offset, readback_data);
     }



    regs.rip -= 1;
    ptrace(PTRACE_SETREGS, child_pid, 0, &regs);

    /* The child can continue running now */
    ptrace(PTRACE_CONT, child_pid, 0, 0);

    wait(&wait_status);
    if (WIFEXITED(wait_status)) {
        procmsg("Child exited\n");
    } else if(WIFSIGNALED(wait_status)) {
    procmsg("signal !!!\n");
    }
    else {
        procmsg("Unexpected signal. %s \n",  strsignal(WSTOPSIG(wait_status)));
    }
 } 

int main(int argc, char** argv)
{
    pid_t child_pid;

    if (argc < 2) {
        fprintf(stderr, "Expected a program name as argument\n");
        return -1;
    }

    child_pid = fork();
    if (child_pid == 0)
        run_target(argv[1]);
    else if (child_pid > 0)
        run_debugger(child_pid);
    else {
        perror("fork");
        return -1;
    }

    return 0;
}

The ./debugger.o hello2 output

[20832] debugger started
[20833] target started. will run 'hello2'
[20832] Child started. RIP = 0x00000000004000b0
[20832] Original data at 0x00000000004000cb: 0x00000000000001b8
[20832] test data_u: 0x000001b8
[20832] After trap,set breakpoint, data at 0x00000000004000cb: 0x00000000000001cc
Hello, 
[20832] Child got a signal: Trace/breakpoint trap
[20832] Child stopped at RIP = 0x00000000004000cc
[20832] poketext origin  back result 0
[20832] After restore, data at 0x4000cb: 0x1b8
[20832] After restore, data at 0x4000cc: 0x1
[20832] After restore, data at 0x4000cd: 0x0
[20832] After restore, data at 0x4000ce: 0x4800000000000000
[20832] After restore, data at 0x4000cf: 0xbe48000000000000
[20832] After restore, data at 0x4000d0: 0xfcbe480000000000
[20832] After restore, data at 0x4000d1: 0xfcbe4800000000
[20832] After restore, data at 0x4000d2: 0x6000fcbe48000000
[20832] After restore, data at 0x4000d3: 0x6000fcbe480000
[20832] After restore, data at 0x4000d4: 0x6000fcbe4800
[20832] After restore, data at 0x4000d5: 0x6000fcbe48
[20832] After restore, data at 0x4000d6: 0x6000fcbe
[20832] After restore, data at 0x4000d7: 0x6000fc
[20832] After restore, data at 0x4000d8: 0xba00000000006000
[20832] After restore, data at 0x4000d9: 0x7ba000000000060
[20832] After restore, data at 0x4000da: 0x7ba0000000000
[20832] After restore, data at 0x4000db: 0x7ba00000000
[20832] After restore, data at 0x4000dc: 0x7ba000000
[20832] After restore, data at 0x4000dd: 0xf00000007ba0000
[20832] After restore, data at 0x4000de: 0x50f00000007ba00
[20832] After restore, data at 0x4000df: 0xb8050f00000007ba
[20832] After restore, data at 0x4000e0: 0x3cb8050f00000007
[20832] After restore, data at 0x4000e1: 0x3cb8050f000000
[20832] After restore, data at 0x4000e2: 0x3cb8050f0000
[20832] After restore, data at 0x4000e3: 0x3cb8050f00
[20832] Unexpected signal. Segmentation fault

Clearly, I just make long to unsigned and write back and print in a loop.

......
unsigned data = ptrace(PTRACE_PEEKTEXT, child_pid, (void*)addr, 0);
     procmsg("After restore, data at 0x%llx: 0x%llx\n", addr, readback_data);
......
     int offset = 0;
     for(offset = 1; offset < 25; offset++) {
       readback_data = ptrace(PTRACE_PEEKTEXT, child_pid, (void*)(addr+offset), 0);
       procmsg("After restore, data at 0x%llx: 0x%llx\n", addr+offset, readback_data);
     }
.....

At last, the output,
[20832] After restore, data at 0x4000d0: 0xfcbe480000000000,
shows the instruction in memory 4000d0: bf 01 00 00 00 mov $0x1,%edi is written to zero. That causes the Segmentation fault as expected.

I am satisfied with the answer by now. ~~