ptrace

linux ptrace系统调用探究

由 落爺英雄遲暮 提交于 2020-03-06 17:21:43
1. ptrace 函数简介 Ptrace是一个系统调用，它提供了一种方法来让‘父’进程可以观察和控制其它进程的执行，检查和改变其核心映像以及寄存器。 主要用来实现断点调试和系统调用跟踪。利用ptrace函数，不仅可以劫持另一个进程的调用，修改系统函数调用和改变返回值，而且可以向另一个函数注入代码，修改eip，进入自己的逻辑。这个函数广泛用于调试和信号跟踪工具。 ptrace使用场景： 由于ptrace可以跟踪运行进程并修改寄存器与内存，因此可以用于以下用途。 黑客利用该特性进行代码注入。 不退出进程，进行在线升级。 开发追踪调试工具。 函数定义 #include <sys/ptrace.h> long ptrace(enum __ptrace_request request, pid_t pid, void *addr, void *data); 函数参数解释 request：请求执行的行为，可能选择有 PTRACE_TRACEME //指示父进程跟踪某个子进程的执行。任何传给子进程的信号将导致其停止执行，同时父进程调用wait()时会得到通告。之后，子进程调用exec()时，核心会给它传送SIGTRAP信号，在新程序开始执行前，给予父进程控制的机会。pid, addr, 和 data参数被忽略。 PTRACE_PEEKTEXT, PTRACE_PEEKDATA /

Can ptrace tell if an x86 system call used the 64-bit or 32-bit ABI?

由 倾然丶 夕夏残阳落幕 提交于 2020-02-24 04:46:04
问题 I'm trying to use ptrace to trace all syscalls made by a separate process, be it 32-bit (IA-32) or 64-bit (x86-64). My tracer would run on a 64-bit x86 installation with IA-32 emulation enabled, but ideally would be able to trace both 64-bit and 32-bit applications, including if a 64-bit application forks and execs a 32-bit process. The issue is that, since 32-bit and 64-bit syscall numbers differ, I need to know whether a process is 32-bit or 64-bit to determine which syscall it used, even

Linux Hook 笔记

由 匆匆过客 提交于 2020-02-18 18:10:18
相信很多人对"Hook"都不会陌生,其中文翻译为"钩子".在编程中, 钩子表示一个可以允许编程者插入自定义程序的地方,通常是打包好的程序中提供的接口. 比如,我们想要提供一段代码来分析程序中某段逻辑路径被执行的频率,或者想要在其中 插入更多功能时就会用到钩子. 钩子都是以固定的目的提供给用户的,并且一般都有文档说明. 通过Hook,我们可以暂停系统调用,或者通过改变系统调用的参数来改变正常的输出结果, 甚至可以中止一个当前运行中的进程并且将控制权转移到自己手上. 基本概念 操作系统通过一系列称为系统调用的方法来提供各种服务.他们提供了标准的API来访问下面的 硬件设备和底层服务,比如文件系统. 以32位系统为例,当进程运行系统调用前,会先把系统调用号放到寄存器 %eax 中,并且将该系统调用的参数依次放入寄存器 %ebx, %ecx, %edx 以及 %esi 和 %edi 中. 以write系统调用为例: write(2, "Hello", 5); 在32位系统中会转换成: movl $1, %eax movl $2, %ebx movl $hello,%ecx movl $5, %edx int $0x80 其中 1 为write的系统调用号, 所有的系统调用号码定义在 unistd.h 文件中. $hello表示字符串 "Hello"的地址;

ptrace with PTRACE_PEEKDATA in ubuntu

由 谁都会走 提交于 2020-01-17 05:44:06
问题 I use ubuntu 16.04 64bit to practice ptrace. When I used PTRACE_PEEKDATA,I'm confused. the child process execute "ls",I want get the string pass to SYS_write. I get the string address and length in RCX,RDX with PTARECE_PEEKUSER. However when I use PTRACE_PEEKDATA to get string,the result is wrong. here is result : mmmmar@acer:$ ls ptrace ptrace_1.c ptrace2 ptrace_2.c ptrace3 ptrace_3.C ptrace4 ptrace_4.C mmmmar@acer:$ ./ptrace4 make write call params 81, 140258879076880, 81 get str: H=���s1�H

Hung processes resume if attached to strace

由 半腔热情 提交于 2020-01-06 17:55:37
问题 I have a network program written in C using TCP sockets. Sometimes the client program hangs forever expecting input from server. Specifically, the client hangs on select() call set on an fd intended to read characters sent by server. I am using strace to know where the process got stuck. However, sometimes when I attach the hung client process to strace, it immediately resumes it's execution and properly exits. Not all hung processes exhibit this behavior, some processes stuck in the select()

Add breakpoints and install handlers

由 心已入冬 提交于 2020-01-05 04:37:08
问题 My high-level goal is something like this: void print_backtrace() { void *callstack[128]; int framesC = backtrace(callstack, sizeof(callstack)); printf("backtrace() returned %d addresses\n", framesC); char** strs = backtrace_symbols(callstack, framesC); for(int i = 0; i < framesC; ++i) { if(strs[i]) printf("%s\n", strs[i]); else break; } free(strs); } install_breakpoint_handler("__NSAutoreleaseNoPool", print_backtrace); So, each time the __NSAutoreleaseNoPool function breakpoint is catched,

C - How To Check If Traced Process Is 32 bits?

由 白昼怎懂夜的黑 提交于 2020-01-04 05:01:32
问题 When using ptrace_attach.How can you know if the process you're attaching is running in 32 or 64 bits ? I'm coding a little strace-like and I need to know if it's 32 or 64 bits because the number of the syscalls in RAX(EAX) will not have the same meaning. When you're tracing a cmd (strace ls) it's quiet simple, you mmap the binary and you perform some checking with Elf. But I cannot find anything regarding an already existing process ? Thank you ! 回答1: This is quite an interesting question.

How to ptrace a multi-threaded application?

由 点点圈 提交于 2019-12-30 01:26:07
问题 EDIT (MADE PROGRESS): I am trying to ptrace a vsftpd daemon. I have the following code which is attaching to the daemon. Then it successfully displays the PID of the first spawned process. However, for the children of this spawned process it returns the PIDs as 2,3,.. The program does catch the exiting of the spawned processes though, which makes me think I am close. Any ideas? void * trace_process(void * pid){ pid_t child = atoi((char *) pid); long orig_eax, eax; int status; int callmade =

system call tracing using ptrace

由 心不动则不痛 提交于 2019-12-29 09:23:36
问题 I wrote a program to list all the system calls executed by a command (say /bin/ls). Now what I am trying to do is find all the system call arguments, environment variables, command line arguments that may be passed to it Example: If I open a file. The system call sys_access will open the file right ? But how to get these values? Want to do this for system calls like open, read, write, close. As per my study these must be in the registers (ebx - edx) If so what does these register values

Linux下交叉编译gdb，gdbserver+gdb的使用以及通过gdb调试core文件

由 放肆的年华 提交于 2019-12-27 04:27:44
交叉编译gdb和gdbserver 1、下载gdb： 下载地址为： http://ftp.gnu.org/gnu/gdb/ 按照一般的想法，最新版本越好，因此下载7.2这个版本。当然，凡事无绝对。 我们以gdb-7.2.tar.bz2 这个文件为例。 2、解压缩： $ tar jxvf gdb-7.2.tar.bz2 注：小技巧：Linux下一般压缩文件后缀为.tar.bz2和.tar.gz，它们解压命令有两三个选项是一致的： xf（v），前者再加上j选项，后者再加上z选项。 3、进入该目录 $ cd gdb-7.2/ 4、配置 $./configure --target=arm-linux --program-prefix=arm-linux- --prefix=/usr/local/arm-gdb 注 ：--target=arm-linux 意思是说目标平台是运行于ARM体系结构的linux内核 ；--program-prefix=arm-linux- 是指生成的可执行文件的前缀，比如arm-linux-gdb ，--prefix 是指生成的可执行文件安装在哪个目录，这个目录需要根据实际情况作选择。如果该目录不存在，会自动创建，当然，权限足够的话。 5、编译、安装 $ make $ make install 幸运的话，会在--prefix指定的目录下生成三个子目录：bin
订阅 ptrace