Wiki‎ > ‎

Memory editing

posted Jun 7, 2016, 11:40 PM by Danny Xu   [ updated Aug 2, 2016, 3:45 PM ]
Windows: cheat engine http://www.cheatengine.org/

============================
 

Aattach fails with ptrace: Operation not permitted

won't attach to process

I found the issue:

https://wiki.ubuntu.com/SecurityTeam/Roadmap/KernelHardening#ptrace%20Protection

http://askubuntu.com/questions/146160/what-is-the-ptrace-scope-workaround-for-wine-programs-and-are-there-any-risks

And the solution is just either do this (as root):

$ echo 0 > /proc/sys/kernel/yama/ptrace_scope

or

echo 0|sudo tee /proc/sys/kernel/yama/ptrace_scope

…or make it permanent by setting ptrace_scope to 0 in /etc/sysctl.d/10-ptrace.conf

========================

In Maverick Meerkat (10.10) Ubuntu introduced a patch to disallow ptracing of non-child processes by non-root users - ie. only a process which is a parent of another process can ptrace it for normal users - whilst root can still ptrace every process. Hence why you can use gdb to attach via sudo still.

You can temporarily disable this restriction (and revert to the old behaviour allowing your user to ptrace (gdb) any of their other processes) by doing:

echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope

To permanently allow it edit /etc/sysctl.d/10-ptrace.conf and change the line:

kernel.yama.ptrace_scope = 1

To read

kernel.yama.ptrace_scope = 0

For some background on why this change was made, see the Ubuntu wiki

Comments