StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
primarykey
Id
12016223
data
AcceptedAnswerId
0
AnswerCount
0
ClosedDate
CommentCount
14
CommunityOwnedDate
CreationDate
2012-08-18T05:55:35.933
FavoriteCount
0
LastActivityDate
2012-08-18T18:00:03.887
LastEditDate
2012-08-18T18:00:03.887
LastEditorUserId
1560320
OwnerUserId
1560320
ParentId
12015141
PostTypeId
2
Score
7
ViewCount
0
LastEditorDisplayName
text
Body
Well it seems that sometimes <code>PTRACE_KILL</code> does not work very well, you can use <code>kill</code> instead: <pre><code>if (orig_eax == 10) { kill(pid, SIGKILL); } </code></pre> EDIT : I test on my machine (Ubuntu kernel 3.4) with this program and all is ok: <pre><code>#include <sys/ptrace.h> #include <sys/types.h> #include <sys/wait.h> #include <unistd.h> #include <sys/reg.h> #include <stdio.h> int main(int argc, char **argv) { pid_t child; long orig_eax; int status; child = fork(); if(child == 0) { ptrace(PTRACE_TRACEME, 0, NULL, NULL); execl("/bin/ls", "ls", NULL); } else { /* Both wait and waitpid works */ //wait(NULL); waitpid(child, &status, 0); orig_eax = ptrace(PTRACE_PEEKUSER, child, 4 * ORIG_EAX, NULL); /* Tracking execve syscall */ if (orig_eax == 11) { /* Both PTRACE_KILL and kill() works on my 3.4.4 Kernel */ fprintf(stdout, "GOT IT\n"); //ptrace(PTRACE_KILL, child, NULL, NULL); kill(child, SIGKILL); } } return 0; } </code></pre> UPDATE : The problem is that you are using <code>10</code> for tracking system call instead of <code>11</code>(because you are executing <code>execve</code> command), this code will work with your <code>rm</code> command: <pre><code>if (orig_eax == 11) { /* Both PTRACE_KILL and kill() works on my 3.4.4 Kernel */ fprintf(stdout, "INSIDE THE TRAP, FILE WILL NOT BE REMOVED\n"); ptrace(PTRACE_KILL, child, NULL, NULL); //kill(child, SIGKILL); } </code></pre> EDIT : I try this code and all wroks fine (the file <code>abc.out</code> still exist after the execution of <code>CALL_REMOVE</code>) <pre><code>/* * REMOVE.c * gcc -Wall REMOVE.c -o REMOVE */ #include <stdio.h> #include <stdlib.h> #include <unistd.h> int main(int argc, char **argv) { /* Both calls work */ //remove("/root/abc.out"); unlink("/root/abc.out"); return 0; } /* * CALL_REMOVE.c * gcc -Wall CALL_REMOVE.c -o CALL_REMOVE */ #include <signal.h> #include <syscall.h> #include <sys/ptrace.h> #include <sys/types.h> #include <sys/wait.h> #include <unistd.h> #include <errno.h> #include <sys/user.h> #include <sys/reg.h> #include <sys/syscall.h> #include <stdio.h> #include <string.h> int main(int argc, char **argv) { int i; pid_t child; int status; long orig_eax; int kill_ret = 0; child = fork(); if(child == 0) { ptrace(PTRACE_TRACEME, 0, NULL, NULL); execl("/root/REMOVE", "REMOVE", NULL); } else { i = 0; while(1) { wait(&status); if (WIFEXITED(status) || WIFSIGNALED(status) ) break; orig_eax = ptrace(PTRACE_PEEKUSER, child, 4 * ORIG_EAX, NULL); if (orig_eax == 10) { fprintf(stderr, "Got it\n"); kill_ret = kill(child, SIGKILL); if (kill_ret == -1) { fprintf(stderr, "Failed to kill ---> %s\n", strerror(errno)); } } printf("%d time, system call %ld\n", i++, orig_eax); ptrace(PTRACE_SYSCALL, child, NULL, NULL); } } return 0; } </code></pre> We got this output: <pre><code>root@UnixServer:/root# ll total 28K -rw-r--r-- 1 root root 6 2012-08-18 19:37 abc.out -rw-r--r-- 1 root root 1023 2012-08-18 19:39 CALL_REMOVE.c -rw-r--r-- 1 root root 213 2012-08-18 19:39 REMOVE.c -rwxr-xr-x 1 root root 7,3K 2012-08-18 19:39 CALL_REMOVE -rwxr-xr-x 1 root root 7,0K 2012-08-18 19:39 REMOVE root@UnixServer:/root# ./CALL_REMOVE 0 time, system call 11 1 time, system call 45 2 time, system call 45 3 time, system call 33 4 time, system call 33 5 time, system call 192 6 time, system call 192 7 time, system call 33 8 time, system call 33 9 time, system call 5 10 time, system call 5 11 time, system call 197 12 time, system call 197 13 time, system call 192 14 time, system call 192 15 time, system call 6 16 time, system call 6 17 time, system call 33 18 time, system call 33 19 time, system call 5 20 time, system call 5 21 time, system call 3 22 time, system call 3 23 time, system call 197 24 time, system call 197 25 time, system call 192 26 time, system call 192 27 time, system call 192 28 time, system call 192 29 time, system call 192 30 time, system call 192 31 time, system call 6 32 time, system call 6 33 time, system call 192 34 time, system call 192 35 time, system call 243 36 time, system call 243 37 time, system call 125 38 time, system call 125 39 time, system call 125 40 time, system call 125 41 time, system call 125 42 time, system call 125 43 time, system call 91 44 time, system call 91 Got it 45 time, system call 10 root@UnixServer:/root# ll total 28K -rw-r--r-- 1 root root 6 2012-08-18 19:37 abc.out -rw-r--r-- 1 root root 1023 2012-08-18 19:39 CALL_REMOVE.c -rw-r--r-- 1 root root 213 2012-08-18 19:39 REMOVE.c -rwxr-xr-x 1 root root 7,3K 2012-08-18 19:39 CALL_REMOVE -rwxr-xr-x 1 root root 7,0K 2012-08-18 19:39 REMOVE root@UnixServer:/root# </code></pre>
Tags
Title
singulars
PostAcceptedAnswerId
1. This table or related slice is empty.
PostParentId
1. POCancel a system call with ptrace()
 singulars
 PostTypePostTypeId
 PTQuestion
PostTypePostTypeId
1. PTAnswer
UserLastEditorUserId
1. USTOC
UserOwnerUserId
1. USTOC
plurals
PostLinksPostIdRelatedPostId
1. This table or related slice is empty.
PostLinksRelatedPostIdPostId
1. This table or related slice is empty.
PostsAcceptedAnswerId
1. POCancel a system call with ptrace()
 singulars
 PostTypePostTypeId
 PTQuestion
PostsParentIdCreationDate
1. This table or related slice is empty.
VotesPostIdCreationDate
1. VO
 singulars
 PostPostId
 PO
 UserUserId
 This table or related slice is empty.
 VoteTypeVoteTypeId
 VTUpMod
2. VO
 singulars
 PostPostId
 PO
 UserUserId
 This table or related slice is empty.
 VoteTypeVoteTypeId
 VTUpMod
3. VO
 singulars
 PostPostId
 PO
 UserUserId
 This table or related slice is empty.
 VoteTypeVoteTypeId
 VTAcceptedByOriginator
CommentsPostId

Querying!

Guidance

A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.