title: C - read() returns negative number
body: <p>Im trying to write a simple program that hooks into another binary (setuid binary, child process run it) using ptrace(), opens a 'flag' file and prints its content.
  The hook works, and i can control the binary using ptrace commands.
  I've executed syscall open(), and got a legitimate file descriptor(4).</p>
  <p>My problem is that syscall read() fails, and returns a negative value of bytes, -21. errno is set to 0 (success). The machine is remote (32-bits), and i cannot install libexplain library there.
  I've searched the web ALOT, yet found no answers regarding the meaning of negative return values of read() syscall (according to the manual page, its only error value is -1..).</p>
  <p><a href="https://i.stack.imgur.com/XknVQ.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/XknVQ.png" alt="enter image description here" /></a></p>
  <p>parent's code:</p>
  <pre><code>int run_syscall(pid_t pid, int syscall_number, int first_paramter, int second_parameter, int third_paramter) {
  struct user_regs_struct regs = { 0 };
  ptrace(PTRACE_GETREGS, pid, 0, &amp;regs);
  regs.eip = INT80;
  regs.eax = syscall_number;
  regs.ebx = first_paramter;
  regs.ecx = second_parameter;
  regs.edx = third_paramter;
  ptrace(PTRACE_SETREGS, pid, 0, &amp;regs);
  ptrace(PTRACE_SINGLESTEP, pid, 0, 0);}
  
  
  // eax = 5 (open), ebx = 'flag' path, ecx = 0, edx = 0
  run_syscall(pid, 5, 0x8048200, 0 , 0); 
  wait(NULL);
  ptrace(PTRACE_GETREGS, pid, 0, &amp;regs);
  int flag_fd = regs.eax;                 // success, returns fd = 4
  printf(&quot;Open syscall worked, flag fd: %d\n&quot;, flag_fd);
  printf(&quot;[*]Syscall was made..\nRegisters values:\nEAX:%08x\nORIG_EAX:%08x\nESP:%08x\nEBP:%08x\nEIP:%08x, should be 0xf7742b59\n\n\n\n\n\n&quot;, regs.eax, regs.orig_eax, regs.esp, regs.ebp, regs.eip);
  long flag_addr = ptrace(PTRACE_PEEKTEXT, pid, regs.esp + 0x1000 - 8, 0);
  long flag = ptrace(PTRACE_PEEKTEXT, pid, flag_addr, 0);
  printf(&quot;Before read() text: %p\n&quot;, flag);
  
  // eax = 3 (read), ebx = opened filedescriptor, ecx = address i want to store the flag content, edx = 1 byte to read
  run_syscall(pid, 3, flag_fd, flag_addr, 1); // Read
  wait(NULL);
  ptrace(PTRACE_GETREGS, pid, 0, &amp;regs);
  printf(&quot;read %d bytes\n&quot;,  regs.eax); // regs.eax = -21 
  printf(&quot;errno: %d\n&quot;, errno); // errno = 0
  printf(&quot;Description: %s\n&quot;, strerror(errno));
  flag = ptrace(PTRACE_PEEKTEXT, pid, flag_addr, 0);
  printf(&quot;After read() text: %p\n&quot;, flag); // remains the same
  </code></pre>
  <p>i made sure that the destination address (flag_addr) is located in writeable memory area (the stack).</p>
  <p>I've also tried different sizes to read (edx), in order to check if something was wrong with the alignment. Unfortunately the bug remains, and read() always returns with -21 (even if edx set to 0).</p>
  <p>I will be very glad if someone knows what status the return value of -21 means, and how can i fix my code..</p>
  <p>thank you.</p>
  <p>EDIT:
  solved. The problem was that the file was named 'flag.txt', but it was a directory! what a troll</p>