Attachment 317591 Details for Bug 455060 – Hijack the ptrace syscall

Hijack the ptrace syscall

ptrace_hijack.c (text/x-csrc), 3.68 KB, created by Jerome Marchand on 2008-09-24 14:21:10 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jerome Marchand

Created: 2008-09-24 14:21:10 UTC

Size: 3.68 KB

patch

obsolete

>#include <stdio.h>
>#include <sys/types.h>
>#include <signal.h>
>
>#include <dlfcn.h>
># define RTLD_NEXT      ((void *) -1l)
>
>//#include <sys/ptrace.h>
>/* Type of the REQUEST argument to `ptrace.'  */
>enum __ptrace_request
>{
>  /* Indicate that the process making this request should be traced.
>     All signals received by this process can be intercepted by its
>     parent, and its parent can use the other `ptrace' requests.  */
>  PTRACE_TRACEME = 0,
>#define PT_TRACE_ME PTRACE_TRACEME
>
>  /* Return the word in the process's text space at address ADDR.  */
>  PTRACE_PEEKTEXT = 1,
>#define PT_READ_I PTRACE_PEEKTEXT
>
>  /* Return the word in the process's data space at address ADDR.  */
>  PTRACE_PEEKDATA = 2,
>#define PT_READ_D PTRACE_PEEKDATA
>
>  /* Return the word in the process's user area at offset ADDR.  */
>  PTRACE_PEEKUSER = 3,
>#define PT_READ_U PTRACE_PEEKUSER
>
>  /* Write the word DATA into the process's text space at address ADDR.  */
>  PTRACE_POKETEXT = 4,
>#define PT_WRITE_I PTRACE_POKETEXT
>
>  /* Write the word DATA into the process's data space at address ADDR.  */
>  PTRACE_POKEDATA = 5,
>#define PT_WRITE_D PTRACE_POKEDATA
>
>  /* Write the word DATA into the process's user area at offset ADDR.  */
>  PTRACE_POKEUSER = 6,
>#define PT_WRITE_U PTRACE_POKEUSER
>
>  /* Continue the process.  */
>  PTRACE_CONT = 7,
>#define PT_CONTINUE PTRACE_CONT
>
>  /* Kill the process.  */
>  PTRACE_KILL = 8,
>#define PT_KILL PTRACE_KILL
>
>  /* Single step the process.
>     This is not supported on all machines.  */
>  PTRACE_SINGLESTEP = 9,
>#define PT_STEP PTRACE_SINGLESTEP
>
>  /* Get all general purpose registers used by a processes.
>     This is not supported on all machines.  */
>   PTRACE_GETREGS = 12,
>#define PT_GETREGS PTRACE_GETREGS
>
>  /* Set all general purpose registers used by a processes.
>     This is not supported on all machines.  */
>   PTRACE_SETREGS = 13,
>#define PT_SETREGS PTRACE_SETREGS
>
>  /* Get all floating point registers used by a processes.
>     This is not supported on all machines.  */
>   PTRACE_GETFPREGS = 14,
>#define PT_GETFPREGS PTRACE_GETFPREGS
>
>  /* Set all floating point registers used by a processes.
>     This is not supported on all machines.  */
>   PTRACE_SETFPREGS = 15,
>#define PT_SETFPREGS PTRACE_SETFPREGS
>
>  /* Attach to a process that is already running. */
>  PTRACE_ATTACH = 16,
>#define PT_ATTACH PTRACE_ATTACH
>
>  /* Detach from a process attached to with PTRACE_ATTACH.  */
>  PTRACE_DETACH = 17,
>#define PT_DETACH PTRACE_DETACH
>
>  /* Get all extended floating point registers used by a processes.
>     This is not supported on all machines.  */
>   PTRACE_GETFPXREGS = 18,
>#define PT_GETFPXREGS PTRACE_GETFPXREGS
>
>  /* Set all extended floating point registers used by a processes.
>     This is not supported on all machines.  */
>   PTRACE_SETFPXREGS = 19,
>#define PT_SETFPXREGS PTRACE_SETFPXREGS
>
>  /* Continue and stop at the next (return from) syscall.  */
>  PTRACE_SYSCALL = 24,
>#define PT_SYSCALL PTRACE_SYSCALL
>
>  /* Set ptrace filter options.  */
>  PTRACE_SETOPTIONS = 0x4200,
>#define PT_SETOPTIONS PTRACE_SETOPTIONS
>
>  /* Get last ptrace message.  */
>  PTRACE_GETEVENTMSG = 0x4201,
>#define PT_GETEVENTMSG PTRACE_GETEVENTMSG
>
>  /* Get siginfo for process.  */
>  PTRACE_GETSIGINFO = 0x4202,
>#define PT_GETSIGINFO PTRACE_GETSIGINFO
>
>  /* Set new siginfo for process.  */
>  PTRACE_SETSIGINFO = 0x4203
>#define PT_SETSIGINFO PTRACE_SETSIGINFO
>};
>
>long (*next_ptrace)(enum __ptrace_request request, pid_t pid,
>		    void *addr, void *data) = NULL;
>
>long ptrace(enum __ptrace_request request, pid_t pid, void *addr, void *data)
>{
>	long ret;
>
>	if(!next_ptrace)
>		next_ptrace = dlsym(RTLD_NEXT, "ptrace");
>
>	if(request == PTRACE_KILL)
>		ret = kill(pid, SIGKILL);
>	else 
>		ret = next_ptrace(request, pid, addr, data);
>
>	return ret;
>}

Actions: View

Attachments on bug 455060: 317591 | 319135 | 319136 | 319204