How to play with ptrace on x86-64?

Question

I'm following the tutorial here , and modified a little for x86-64 (basically replace eax to rax,etc) so that it compiles:

#include <sys/ptrace.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
#include <sys/user.h>
#include <sys/reg.h>
#include <unistd.h>


int main()
{   pid_t child;
    long orig_eax;
    child = fork();
    if(child == 0) {
        ptrace(PTRACE_TRACEME, 0, NULL, NULL);
        execl("/bin/ls", "ls", NULL);
    }
    else {
        wait(NULL);
        orig_eax = ptrace(PTRACE_PEEKUSER,
                          child, 4 * ORIG_RAX,
                          NULL);
        printf("The child made a "
               "system call %ld\n", orig_eax);
        ptrace(PTRACE_CONT, child, NULL, NULL);
    }
    return 0;
}

But it doesn't actually work as expected, it always says:

The child made a system call -1

What's wrong in the code?

Answer 1

In 64 bit = 8 * ORIG_RAX

8 = sizeof(long)

Answer 2

ptrace returns -1 with errno EIO because what you're trying to read is not correctly aligned. Taken from ptrace manpage:

  PTRACE_PEEKUSER Reads a word at offset addr in the child's USER area, which holds the registers and other information about the process (see <sys/user.h>). The word is returned as the result of the ptrace() call. Typically the offset must be word-aligned, though this might vary by architecture. See NOTES. (data is ignored.) 

In my 64-bits system, 4 * ORIG_RAX is not 8-byte-aligned. Try with values such 0 or 8 and it should work.