0

Playing with ptrace example freespaceinject.c doesn't work

Operating System is Ubuntu 12.04

I am reading "Playing with ptrace". All examples in that article succede except the last example freespaceinject.c.

The process of freespaceinject.c as follows:

  1. Using ptrace with PTRACE_ATTACH to attach dummy2.

  2. Using ptrace with PTRACE_PEEKDATA to inject instructions(including int3) to the free space of dummy2.

  3. Mofify EIP to point to the injected instructions.

  4. dummy2 execute the injected instructions to print "Hello World\n".

  5. freespaceinject restore data and registers.

  6. dummy2 continue to execute.

Freespaceinject did attached to dummy2.But the injected instructions don't work("Hello World\n" not printed), Why? Maybe many yeas passed, many things has changed. I found many websites, but have poor help.

I found an article at https://nnc3.com/mags/LJ_1994-2014/LJ/108/6527.html. It say as follow:

Be Careful with ptrace In “Playing with ptrace, Part II” [LJ, December 2002], Pradeep Padala talked about injecting code into a process and finding some “free space” to put it in to. It's worth noting that the space referred to is not really “free”; it's usually either the cleared space used for global storage in the executable and its shared libraries or the C library's heap storage area. In any case, writing over this data and not restoring it before allowing the execution to continue (as may seem reasonable at first) could cause all sorts of weird behaviour, including program crashes.

I don't know wheather this is the reason.

The detail of my operation as follows:

[ptrace scope setting]

hx@hx-VirtualBox:~/dev/ptrace$ su

root@hx-VirtualBox:/home/hx/dev/ptrace# echo 0 > /proc/sys/kernel/yama/ptrace_scope

root@hx-VirtualBox:/home/hx/dev/ptrace# exit

exit

hx@hx-VirtualBox:~/dev/ptrace$ 

[dummy2.c]

#include <stdio.h>

int main() 
{   int i;
    for(i = 0;i < 10; ++i) {
        printf("My counter: %d \n", i);
        sleep(2);
    }
    return 0;
}

hx@hx-VirtualBox:~/dev/ptrace/tmp3$ gcc -zexecstack dummy2.c -o dummy2

hx@hx-VirtualBox:~/dev/ptrace/tmp3$ ./dummy2

My counter: 0

My counter: 1

My counter: 2

My counter: 3

My counter: 4

My counter: 5

My counter: 6

My counter: 7

My counter: 8

My counter: 9

hx@hx-VirtualBox:~/dev/ptrace/tmp3$ cat /proc/`pgrep dummy2`/maps

08048000-08049000 r-xp 00000000 08:01 54069 /home/hx/dev/ptrace/tmp3/dummy2

08049000-0804a000 r-xp 00000000 08:01 54069 /home/hx/dev/ptrace/tmp3/dummy2

0804a000-0804b000 rwxp 00001000 08:01 54069 /home/hx/dev/ptrace/tmp3/dummy2

b7e20000-b7e21000 rwxp 00000000 00:00 0

b7e21000-b7fc4000 r-xp 00000000 08:01 130959 /lib/i386-linux-gnu/libc-2.15.so

b7fc4000-b7fc6000 r-xp 001a3000 08:01 130959 /lib/i386-linux-gnu/libc-2.15.so

b7fc6000-b7fc7000 rwxp 001a5000 08:01 130959 /lib/i386-linux-gnu/libc-2.15.so

b7fc7000-b7fca000 rwxp 00000000 00:00 0

b7fda000-b7fdd000 rwxp 00000000 00:00 0

b7fdd000-b7fde000 r-xp 00000000 00:00 0 [vdso]

b7fde000-b7ffe000 r-xp 00000000 08:01 130939 /lib/i386-linux-gnu/ld-2.15.so

b7ffe000-b7fff000 r-xp 0001f000 08:01 130939 /lib/i386-linux-gnu/ld-2.15.so

b7fff000-b8000000 rwxp 00020000 08:01 130939 /lib/i386-linux-gnu/ld-2.15.so

bffdf000-c0000000 rwxp 00000000 00:00 0 [stack]

[freespaceinject] hx@hx-VirtualBox:~/dev/ptrace/tmp3$ cat freespaceinject.c

#include <sys/ptrace.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
#include <sys/user.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

const int long_size = sizeof(long);

void getdata(pid_t child, long addr, char *str, int len)
{   char *laddr;
    int i, j;
    union u {
            long val;
            char chars[long_size];
    }data;

    i = 0;
    j = len / long_size;
    laddr = str;
    while(i < j) {
        data.val = ptrace(PTRACE_PEEKDATA, child, addr + i * 4, NULL);
        memcpy(laddr, data.chars, long_size);
        ++i;
        laddr += long_size;
    }
}

void putdata(pid_t child, long addr, char *str, int len)
{   char *laddr;
    int i, j;
    union u {
            long val;
            char chars[long_size];
    }data;

    i = 0;
    j = len / long_size;
    laddr = str;
    while(i < j) {
        memcpy(data.chars, laddr, long_size);
        ptrace(PTRACE_POKEDATA, child, addr + i * 4, data.val);
        ++i;
        laddr += long_size;
    }
}

long freespaceaddr(pid_t pid)
{
    FILE *fp;
    char filename[30];
    char line[85];
    long addr;
    char str[20];

    sprintf(filename, "/proc/%d/maps", pid);
    fp = fopen(filename, "r");
    if(fp == NULL)
        exit(1);
    while(fgets(line, 85, fp) != NULL) {
        sscanf(line, "%lx-%*lx %*s %*s %s", &addr, str, str, str, str);
        if(strcmp(str, "00:00") == 0){
        break;
    }
    }
    fclose(fp);
    return addr;
}

int main(int argc, char *argv[])
{   pid_t traced_process;
    struct user_regs_struct oldregs, regs;
    long ins;
    int len = 44;
    char insertcode[] = "\xeb\x15\x5e\xb8\x04\x00\x00\x00\xbb\x02\x00\x00\x00\x89\xf1\xba\x0c\x00\x00\x00\xcd\x80\xcc\xe8\xe6\xff\xff\xff\x48\x65\x6c\x6c\x6f\x20\x57\x6f\x72\x6c\x64\x0a\x00\x00\x00\x00";
    char backup[len];
    long addr;

    if(argc != 2) {
        printf("Usage: %s <pid to be traced>\n", argv[0], argv[1]);
        exit(1);
    }

    traced_process = atoi(argv[1]);

    ptrace(PTRACE_ATTACH, traced_process, NULL, NULL);
    wait(NULL);

    ptrace(PTRACE_GETREGS, traced_process, NULL, &regs);
    addr = freespaceaddr(traced_process);
    getdata(traced_process, addr, backup, len);
    putdata(traced_process, addr, insertcode, len);
    memcpy(&oldregs, &regs, sizeof(regs));
    regs.eip = addr;
    ptrace(PTRACE_SETREGS, traced_process, NULL, &regs);
    ptrace(PTRACE_CONT, traced_process, NULL, NULL);

    wait(NULL);
    printf("The process stopped, Putting back the original instructions\n");
    putdata(traced_process, addr, backup, len);
    ptrace(PTRACE_SETREGS, traced_process, NULL, &oldregs);
    printf("Letting it continue with original flow\n");
    ptrace(PTRACE_DETACH, traced_process, NULL, NULL);

    return 0;
}

hx@hx-VirtualBox:~/dev/ptrace/tmp3$ ./freespaceinject pgrep dummy2

free addr: b7e20000

The process stopped, Putting back the original instructions

Letting it continue with original flow

[injected code comes from hello.c]

hx@hx-VirtualBox:~/dev/ptrace$ cat hello.c

void main()
{
__asm__ (
         "jmp forward\n\t"
"backward:\n\t"
         "popl   %esi          # Get the address of\n\t"
                              "# hello world string\n\t"
         "movl   $4, %eax      # Do write system call\n\t"
         "movl   $2, %ebx\n\t"
         "movl   %esi, %ecx\n\t"
         "movl   $12, %edx\n\t"
         "int    $0x80\n\t"
         "int3                 # Breakpoint. Here the\n\t"
                              "# program will stop and\n\t"
                              "# give control back to\n\t"
                              "# the parent\n\t"
"forward:\n\t"
        "call   backward\n\t"
        ".string \"Hello World\\n\"\n\t"
       );
}

hx@hx-VirtualBox:~/dev/ptrace$ gcc hello.c -o hello

hx@hx-VirtualBox:~/dev/ptrace$ gdb ./hello

(gdb) disass /r main

Dump of assembler code for function main:

0x080483b4 <+0>: 55 push %ebp

0x080483b5 <+1>: 89 e5 mov %esp,%ebp

0x080483b7 <+3>: eb 15 jmp 0x80483ce //Begin of insertcode

0x080483b9 <+5>: 5e pop %esi

0x080483ba <+6>: b8 04 00 00 00 mov $0x4,%eax

0x080483bf <+11>: bb 02 00 00 00 mov $0x2,%ebx

0x080483c4 <+16>: 89 f1 mov %esi,%ecx

0x080483c6 <+18>: ba 0c 00 00 00 mov $0xc,%edx

0x080483cb <+23>: cd 80 int $0x80

0x080483cd <+25>: cc int3

0x080483ce <+0>: e8 e6 ff ff ff call 0x80483b9

0x080483d3 <+5>: 48 dec %eax

0x080483d4 <+6>: 65 gs

0x080483d5 <+7>: 6c insb (%dx),%es:(%edi)

0x080483d6 <+8>: 6c insb (%dx),%es:(%edi)

0x080483d7 <+9>: 6f outsl %ds:(%esi),(%dx)

0x080483d8 <+10>: 20 57 6f and %dl,0x6f(%edi)

0x080483db <+13>: 72 6c jb 0x8048449 <__libc_csu_init+89>

0x080483dd <+15>: 64 0a 00 or %fs:(%eax),%al //End of insertcode

0x080483e0 <+18>: 5d pop %ebp

0x080483e1 <+19>: c3 ret

End of assembler dump.

3
  • You're probably using a 64-bit machine.
    – hobbs
    Dec 22, 2015 at 8:37
  • It's 32 bit. hx@hx-VirtualBox:~/dev/ptrace/tmp3$ uname -a Linux hx-VirtualBox 3.8.0-29-generic #42~precise1-Ubuntu SMP Wed Aug 14 15:31:16 UTC 2013 i686 i686 i386 GNU/Linux
    – MillionSky
    Dec 22, 2015 at 8:51
  • The code whose output you show is not the code you show - there's nowhere a statement that prints the line free addr: …. The posted code works on Linux 2.4.31 i686 unknown.
    – Armali
    Jan 15, 2018 at 10:10

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.