Re: [EXAMPLE CODE] Parasite thread injection and TCP connection hijacking

On Sat, Aug 06, 2011 at 03:00:37PM +0200, Tejun Heo wrote:

Hello,

On Sat, Aug 06, 2011 at 08:45:28AM -0400, Andy Lutomirski wrote:

quoted

quoted

2. Decide where to inject the foreign code and save the original code
   with PTRACE_PEEKDATA.  Tracer can poke any mapped area regardless
   of protection flags but it can't add execution permission to the
   code, so it needs to choose memory area which already has X flag
   set.  The example code uses the page the %rip is in.

If the process is executing from the vsyscall page, then you'll
probably fail.  (Admittedly, this is rather unlikely, given that the
vsyscalls are now exactly one instruction.)  Presumably you also
fail if executing from a read-only MAP_SHARED mapping.

Heh, yeah, I originally thought about scanning /proc/PID/maps to look
for the page to use but was lazy and just used %rip.  I think that
should work.  I'll note the problem in README.

Okay, updated README.

  http://code.google.com/p/ptrace-parasite/source/browse/README

Thanks.

-- 
tejun