{"action":"created","issue":{"url":"https://api.github.com/repos/yrp604/rappel/issues/2","repository_url":"https://api.github.com/repos/yrp604/rappel","labels_url":"https://api.github.com/repos/yrp604/rappel/issues/2/labels{/name}","comments_url":"https://api.github.com/repos/yrp604/rappel/issues/2/comments","events_url":"https://api.github.com/repos/yrp604/rappel/issues/2/events","html_url":"https://github.com/yrp604/rappel/issues/2","id":138610150,"number":2,"title":"Fail to execute","user":{"login":"HalosGhost","id":49465,"avatar_url":"https://avatars.githubusercontent.com/u/49465?v=3","gravatar_id":"","url":"https://api.github.com/users/HalosGhost","html_url":"https://github.com/HalosGhost","followers_url":"https://api.github.com/users/HalosGhost/followers","following_url":"https://api.github.com/users/HalosGhost/following{/other_user}","gists_url":"https://api.github.com/users/HalosGhost/gists{/gist_id}","starred_url":"https://api.github.com/users/HalosGhost/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/HalosGhost/subscriptions","organizations_url":"https://api.github.com/users/HalosGhost/orgs","repos_url":"https://api.github.com/users/HalosGhost/repos","events_url":"https://api.github.com/users/HalosGhost/events{/privacy}","received_events_url":"https://api.github.com/users/HalosGhost/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-03-04T22:53:56Z","updated_at":"2016-03-05T01:43:52Z","closed_at":null,"body":"When I try to execute any instruction (for example, ``inc rax``), I get the following output before the list of registers (which do not change).\r\n\r\n```\r\nptrace() - failed to write value 0xccccccccccc0ff48 to 0x0000000000400000\r\n```\r\n\r\nWhen executing with ``-v``, I get the following:\r\n\r\n```\r\nTrying to assemble(8):\r\ninc rax\r\n@nasm is pid 6057\r\nProcess 6057 has exited with status 0\r\nGot asm(3):\r\n48 ff c0                                                H..\r\nptrace_write: 0x0000000000400000 = 0xccccccccccc0ff48\r\nptrace() - failed to write value 0xccccccccccc0ff48 to 0x0000000000400000\r\n```\r\n\r\nI am wondering if this is because of Grsec's PaX, but if it is, there was nothing registered in ``dmesg`` as there usually is. Any idea what might be going wrong?\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/yrp604/rappel/issues/comments/192546810","html_url":"https://github.com/yrp604/rappel/issues/2#issuecomment-192546810","issue_url":"https://api.github.com/repos/yrp604/rappel/issues/2","id":192546810,"user":{"login":"yrp604","id":8716677,"avatar_url":"https://avatars.githubusercontent.com/u/8716677?v=3","gravatar_id":"","url":"https://api.github.com/users/yrp604","html_url":"https://github.com/yrp604","followers_url":"https://api.github.com/users/yrp604/followers","following_url":"https://api.github.com/users/yrp604/following{/other_user}","gists_url":"https://api.github.com/users/yrp604/gists{/gist_id}","starred_url":"https://api.github.com/users/yrp604/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yrp604/subscriptions","organizations_url":"https://api.github.com/users/yrp604/orgs","repos_url":"https://api.github.com/users/yrp604/repos","events_url":"https://api.github.com/users/yrp604/events{/privacy}","received_events_url":"https://api.github.com/users/yrp604/received_events","type":"User","site_admin":false},"created_at":"2016-03-05T01:43:52Z","updated_at":"2016-03-05T01:43:52Z","body":"Hm, what is kernel.grsecurity.harden_ptrace? Alternatively if you run it as root, does it work?\r\n\r\nAccording to the docs that sysctl shouldn't affect ptrace in this case (because the tracee is a child process of the tracer) but Im curious. If it's enabled, does disabling it make the problem go away?\r\n\r\nWhen you run it verbosely, it should give you the child pid. Does that process still exist after the failed write?\r\n\r\nWhat does '.read 0x400000 1' return? (from inside rappel).\r\n\r\nI don't have a grsec machine handy at the moment, but will get one spun up after the weekend if we still can't resolve it."}}