PTRACE_TRACEME - Operation not permitted error?

Question

I try to develop my own debugger. I used in child space the code:

//child process asks the OS kernel to let its parent trace it
if (ptrace(PTRACE_TRACEME, 0, NULL, NULL) == -1) {
      perror("ptrace_traceme");
      exit(EXIT_FAILURE);
}

but I got the error:

ptrace_traceme: Operation not permitted

using Ubuntu 22.04.

I tried two ways:

/proc/sys/kernel/yama/ptrace_scope change to 1

and:

echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope

they didn't work, do you have another way or are you faced with that issue? Thanks for your helps!

Related: https://stackoverflow.com/questions/89603/how-does-the-debugging-option-g-change-the-binary-executable — teapot418, Mar 25 '23 at 11:51
That is not related, my bottom line is: How to know where to put the breakpoint in terms of understanding and not written code, for example, if you put a breakpoint in line 23 to us it seems simple, in line 23 in the source code, but how does the debugger know honestly where line 23 is? I would appreciate a verbal explanation — Aviel15, Mar 25 '23 at 12:10

score 1 · Answer 1 · answered Mar 25 '23 at 12:31

When you compile an executable with debugging symbols enabled (cc -g ...), the compiler embeds a variety of metadata in that binary that describe variables and functions and include information about source code lines.

gdb reads this metadata in order to allow you to do things like listing your code, or setting a breakpoint at a specific line/function.

If you were writing your own debugger and wanted to provide the same features, you would need to introduce support for reading this metadata. See the Wikipedia article on DWARF for an introduction to how this metadata is stored.

PTRACE_TRACEME - Operation not permitted error?

1 Answers1