Re: [EXAMPLE CODE] Parasite thread injection and TCP connection hijacking

Hello,

On Sat, Aug 06, 2011 at 08:45:28AM -0400, Andy Lutomirski wrote:

quoted

2. Decide where to inject the foreign code and save the original code
   with PTRACE_PEEKDATA.  Tracer can poke any mapped area regardless
   of protection flags but it can't add execution permission to the
   code, so it needs to choose memory area which already has X flag
   set.  The example code uses the page the %rip is in.

If the process is executing from the vsyscall page, then you'll
probably fail.  (Admittedly, this is rather unlikely, given that the
vsyscalls are now exactly one instruction.)  Presumably you also
fail if executing from a read-only MAP_SHARED mapping.

Heh, yeah, I originally thought about scanning /proc/PID/maps to look
for the page to use but was lazy and just used %rip.  I think that
should work.  I'll note the problem in README.

Windows has a facility to more-or-less call mmap on behalf of
another process, and another one to directly inject a thread into a
remote process.  It's traditional to use them for this type of
manipulation. Perhaps Linux should get the same thing.  (Although
you could accomplish much the same thing if you could create a task
with your mm but the tracee's fs.)

Actually, the only thing we need on x86_64 is two bytes for the
syscall instruction because all params are passed through registers
anyway.  We can just set up parameters for mmap, turn on single step,
point %rip to syscall in the vsyscall page.  So, either way, I don't
think this would be too difficult to solve.

Thanks.

-- 
tejun