How to modify EIP's tracee forked procee?

前端 未结 2 1433
小鲜肉
小鲜肉 2021-01-24 09:30

I\'m working on a Linux application incorporating ptrace to observe another process which had been created by fork() system call.

Strictly speaking: I want to implement

2条回答
  •  感情败类
    2021-01-24 10:16

    You're not modifying the EIP, you're adding something to the value of the instruction at EIP, and probably resulting in a bad address reference. To change EIP, use PTRACE_SETREGS

          wait(NULL);
          ptrace(PTRACE_GETREGS, child,NULL, ®s);
          printf("\n EIP @  0x %#lx\n",regs.eip);
          regs.eip += ???;
          ptrace(PTRACE_SETREGS, child, NULL, ®s);
          ptrace(PTRACE_CONT, child, NULL, NULL);
    

提交回复
热议问题