4.8 KiB
2 files
0 directories
Index of /files/scripts/c/ptrace_auto/
README.md
A slightly more advanced example of how to automatically attach to a process using `ptrace`, find the starting memory address of the process' memory segment (for `dummy.c`), and then finally use a predefined pattern to change a randomly generated variable within the dummy program. The pattern is here used as a way of finding where the random value is, as it's in the same struct as the pattern.

How can it be used? Simply compile both programs using gcc, then spin up the dummy program, and while it's running, execute the injector program. This assumes that you have no other processes running named dummy.

This'll essentially find the process ID of the dummy, attach to it using ptrace, find the address of the memory segment start, scan the addresses sequentially (address += sizeof(long)) until we find the pattern (0xDEADBEEF). When we have that, we also know (through simple memory analysis), that the upper half of the address value contains our randomised value. This value can be extracted (for fun), and we can then construct an updated value by combining a new value with the preserved pattern.

maelstrom> $ ./dummy
[PID: 39699] Current value: 2074537478, rechecking in 10s...
[PID: 39699] Current value: 9999, rechecking in 10s...
maelstrom> $ ./injector
Found PID: 39699
Got memory segment of process: 0x56069ca31000
Attached to PID: 39699
Found value: 2074537478
 > at address: 0x56069ca31048
OK, set value to 0x270fdeadbeef at address: 0x56069ca31048

Here, we can see that the new value (0x270fdeadbeef) is a combination of the pattern and the hex value of 9999 = 0x270f which is what we're changing it to. This is also how we're reading and detecting the correct address to begin with, as we're looking for a value ending in (0xdeadbeef). This allows us to extract the current value easily and also to create a new one as well.

Filename Modified Size Type
[Parent Directory]---
injector.c16/02/25 00:2216/02/254.3 KiB[Download][Save]
dummy.c15/02/25 23:0415/02/25425 B[Download][Save]
Page generated in 0.003206s
Browsing /files/scripts/c/ptrace_auto @ five.sh
IVFi1.2.2+
Contact | DMCA | Status | Recent Uploads