11的个人空间 https://www.routerclub.com/?499 [收藏] [复制] [分享] [RSS]

日志

使用injectso 技术注入mtrace，对进程进行内存检测。

已有 3839 次阅读2013-5-4 12:09

<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); ">这里，我们可以采用injectso技术，在程序外面使被跟踪的程序调用mtrace，来实现。

<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); ">因为mtrace属于libc最基本的库，所以不必采用_dl_open来载入相应的库。

<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); ">主要参考<a href="http://blog.chinaunix.net/u/30686/showart_272157.html" .="word-wrap: break-word; text-decoration: none; color: rgb(86, 86, 86); " target="_blank">http://blog.chinaunix.net/u/30686/showart_272157.html

<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); ">#include <sys/ptrace.h><br .="word-wrap: break-word; ">#include <sys/types.h><br .="word-wrap: break-word; ">#include <sys/wait.h><br .="word-wrap: break-word; ">#include <unistd.h><br .="word-wrap: break-word; ">#include <linux/user.h><br .="word-wrap: break-word; ">#include <gelf.h><br .="word-wrap: break-word; ">#include <stdio.h><br .="word-wrap: break-word; ">#include <string.h><br .="word-wrap: break-word; ">#include <stdlib.h><br .="word-wrap: break-word; ">#include <errno.h><br .="word-wrap: break-word; ">#include <link.h><div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); ">#define IMAGE_ADDR 0x08048000<br .="word-wrap: break-word; ">void ptrace_readreg(int pid, struct user_regs_struct regs);<br .="word-wrap: break-word; ">void ptrace_writereg(int pid, struct user_regs_struct regs);<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); ">struct user_regs_struct oldregs;<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); ">void ptrace_attach(int pid)<br .="word-wrap: break-word; ">{<br .="word-wrap: break-word; "> if(ptrace(PTRACE_ATTACH, pid, NULL, NULL) < 0) {<br .="word-wrap: break-word; "> perror("ptrace_attach");<br .="word-wrap: break-word; "> exit(-1);<br .="word-wrap: break-word; "> }<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> waitpid(pid, NULL, WUNTRACED); <br .="word-wrap: break-word; "> <br .="word-wrap: break-word; "> ptrace_readreg(pid, &oldregs);<br .="word-wrap: break-word; ">}<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); ">void ptrace_cont(int pid)<br .="word-wrap: break-word; ">{<br .="word-wrap: break-word; "> int stat;<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> if(ptrace(PTRACE_CONT, pid, NULL, NULL) < 0) {<br .="word-wrap: break-word; "> perror("ptrace_cont");<br .="word-wrap: break-word; "> exit(-1);<br .="word-wrap: break-word; "> }<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> while(!WIFSTOPPED(stat))<br .="word-wrap: break-word; "> waitpid(pid, &stat, WNOHANG);<br .="word-wrap: break-word; ">}<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); ">void ptrace_detach(int pid)<br .="word-wrap: break-word; ">{<br .="word-wrap: break-word; "> ptrace_writereg(pid, &oldregs);<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> if(ptrace(PTRACE_DETACH, pid, NULL, NULL) < 0) {<br .="word-wrap: break-word; "> perror("ptrace_detach");<br .="word-wrap: break-word; "> exit(-1);<br .="word-wrap: break-word; "> }<br .="word-wrap: break-word; ">}<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); ">void ptrace_write(int pid, unsigned long addr, void vptr, int len)<br .="word-wrap: break-word; ">{<br .="word-wrap: break-word; "> int count;<br .="word-wrap: break-word; "> long word;<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> count = 0;<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> while(count < len) {<br .="word-wrap: break-word; "> memcpy(&word, vptr + count, sizeof(word));<br .="word-wrap: break-word; "> word = ptrace(PTRACE_POKETEXT, pid, addr + count, word);<br .="word-wrap: break-word; "> count += 4;<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> if(errno != 0)<br .="word-wrap: break-word; "> printf("ptrace_write failed\t %ld\n", addr + count);<br .="word-wrap: break-word; "> }<br .="word-wrap: break-word; ">}<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); ">void ptrace_read(int pid, unsigned long addr, void vptr, int len)<br .="word-wrap: break-word; ">{<br .="word-wrap: break-word; "> int i,count;<br .="word-wrap: break-word; "> long word;<br .="word-wrap: break-word; "> unsigned long ptr = (unsigned long )vptr;<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> i = count = 0;<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> while (count < len) {<br .="word-wrap: break-word; "> word = ptrace(PTRACE_PEEKTEXT, pid, addr + count, NULL);<br .="word-wrap: break-word; "> count += 4;<br .="word-wrap: break-word; "> ptr[i++] = word;<br .="word-wrap: break-word; "> }<br .="word-wrap: break-word; ">}<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); ">char ptrace_readstr(int pid, unsigned long addr)<br .="word-wrap: break-word; ">{<br .="word-wrap: break-word; "> char str = (char ) malloc(64);<br .="word-wrap: break-word; "> int i,count;<br .="word-wrap: break-word; "> long word;<br .="word-wrap: break-word; "> char pa;<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> i = count = 0;<br .="word-wrap: break-word; "> pa = (char )&word;<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> while(i <= 60) {<br .="word-wrap: break-word; "> word = ptrace(PTRACE_PEEKTEXT, pid, addr + count, NULL);<br .="word-wrap: break-word; "> count += 4;<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> if (pa[0] == '\0') {<br .="word-wrap: break-word; "> str[i] = '\0';<br .="word-wrap: break-word; "> break;<br .="word-wrap: break-word; "> }<br .="word-wrap: break-word; "> else<br .="word-wrap: break-word; "> str[i++] = pa[0];<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> if (pa[1] == '\0') {<br .="word-wrap: break-word; "> str[i] = '\0';<br .="word-wrap: break-word; "> break;<br .="word-wrap: break-word; "> }<br .="word-wrap: break-word; "> else<br .="word-wrap: break-word; "> str[i++] = pa[1];<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> if (pa[2] == '\0') {<br .="word-wrap: break-word; "> str[i] = '\0';<br .="word-wrap: break-word; "> break;<br .="word-wrap: break-word; "> }<br .="word-wrap: break-word; "> else<br .="word-wrap: break-word; "> str[i++] = pa[2];<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> if (pa[3] == '\0') {<br .="word-wrap: break-word; "> str[i] = '\0';<br .="word-wrap: break-word; "> break;<br .="word-wrap: break-word; "> }<br .="word-wrap: break-word; "> else<br .="word-wrap: break-word; "> str[i++] = pa[3];<br .="word-wrap: break-word; "> }<br .="word-wrap: break-word; "> <br .="word-wrap: break-word; "> return str;<br .="word-wrap: break-word; ">}<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); ">void ptrace_readreg(int pid, struct user_regs_struct regs)<br .="word-wrap: break-word; ">{<br .="word-wrap: break-word; "> if(ptrace(PTRACE_GETREGS, pid, NULL, regs))<br .="word-wrap: break-word; "> printf(" ptrace_readreg error \n");<br .="word-wrap: break-word; "> <br .="word-wrap: break-word; "> return ;<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); ">}<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); ">void ptrace_writereg(int pid, struct user_regs_struct *regs)<br .="word-wrap: break-word; ">{<br .="word-wrap: break-word; "> if(ptrace(PTRACE_SETREGS, pid, NULL, regs))<br .="word-wrap: break-word; "> printf(" ptrace_writereg error \n");<br .="word-wrap: break-word; "> <br .="word-wrap: break-word; "> return ;<br .="word-wrap: break-word; ">}<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); ">void ptrace_push(int pid, void paddr, int size)<br .="word-wrap: break-word; ">{<br .="word-wrap: break-word; "> unsigned long esp;<br .="word-wrap: break-word; "> struct user_regs_struct regs;<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> ptrace_readreg(pid, &regs);<br .="word-wrap: break-word; "> esp = regs.esp;<br .="word-wrap: break-word; "> esp -= size;<br .="word-wrap: break-word; "> esp = esp - esp % 4;<br .="word-wrap: break-word; "> regs.esp = esp;<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> ptrace_writereg(pid, &regs);<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> ptrace_write(pid, esp, paddr, size);<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> return (void )esp;<br .="word-wrap: break-word; ">}<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); ">void ptrace_call(int pid, unsigned long addr)<br .="word-wrap: break-word; ">{<br .="word-wrap: break-word; "> void pc;<br .="word-wrap: break-word; "> struct user_regs_struct regs;<br .="word-wrap: break-word; "> int stat;<br .="word-wrap: break-word; "> void pra;<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> pc = (void ) 0x41414140;<br .="word-wrap: break-word; "> pra = ptrace_push(pid, &pc, sizeof(pc));<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> ptrace_readreg(pid, &regs);<br .="word-wrap: break-word; ">// ptrace_readreg(pid, &oldregs);<br .="word-wrap: break-word; "> regs.eip = addr;<br .="word-wrap: break-word; "> ptrace_writereg(pid, &regs);<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> ptrace_cont(pid);<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> while(!WIFSIGNALED(stat))<br .="word-wrap: break-word; "> waitpid(pid, &stat, WNOHANG);<br .="word-wrap: break-word; "> <br .="word-wrap: break-word; ">// ptrace_writereg(pid,&oldregs);<br .="word-wrap: break-word; ">// ptrace_cont(pid);<br .="word-wrap: break-word; ">}<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); ">int nchains;<br .="word-wrap: break-word; ">unsigned long symtab,strtab,jmprel,totalrelsize,relsize,nrels,dyn_addr;<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); ">struct link_map get_linkmap(int pid)<br .="word-wrap: break-word; ">{<br .="word-wrap: break-word; "> Elf32_Ehdr ehdr = (Elf32_Ehdr ) malloc(sizeof(Elf32_Ehdr)); <br .="word-wrap: break-word; "> Elf32_Phdr phdr = (Elf32_Phdr ) malloc(sizeof(Elf32_Phdr));<br .="word-wrap: break-word; "> Elf32_Dyn dyn = (Elf32_Dyn ) malloc(sizeof(Elf32_Dyn));<br .="word-wrap: break-word; "> Elf32_Word got;<br .="word-wrap: break-word; "> struct link_map map = (struct link_map )malloc(sizeof(struct link_map));<br .="word-wrap: break-word; "> int i = 0;<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> ptrace_read(pid, IMAGE_ADDR, ehdr, sizeof(Elf32_Ehdr));<br .="word-wrap: break-word; "> long phdr_addr;<br .="word-wrap: break-word; "> phdr_addr = IMAGE_ADDR + ehdr->e_phoff;<br .="word-wrap: break-word; "> printf("phdr_addr\t %p\n", phdr_addr);<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> ptrace_read(pid, phdr_addr, phdr, sizeof(Elf32_Phdr));<br .="word-wrap: break-word; "> while(phdr->p_type != PT_DYNAMIC)<br .="word-wrap: break-word; "> ptrace_read(pid, phdr_addr += sizeof(Elf32_Phdr), phdr,<br .="word-wrap: break-word; "> sizeof(Elf32_Phdr));<br .="word-wrap: break-word; "> long dyn_addr = phdr->p_vaddr;<br .="word-wrap: break-word; "> printf("dyn_addr\t %p\n", dyn_addr);<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> ptrace_read(pid, dyn_addr, dyn, sizeof(Elf32_Dyn));<br .="word-wrap: break-word; "> while(dyn->d_tag != DT_PLTGOT) {<br .="word-wrap: break-word; "> ptrace_read(pid, dyn_addr + i sizeof(Elf32_Dyn), dyn, sizeof(Elf32_Dyn));<br .="word-wrap: break-word; "> i++;<br .="word-wrap: break-word; "> }<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> got = (Elf32_Word)dyn->d_un.d_ptr;<br .="word-wrap: break-word; "> got += 4;<br .="word-wrap: break-word; "> printf("GOT\t\t %p\n", got);<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> unsigned long map_addr;<br .="word-wrap: break-word; "> ptrace_read(pid,(unsigned long)(got), &map_addr, 4);<br .="word-wrap: break-word; "> printf("map_addr\t %p\n", map_addr);<br .="word-wrap: break-word; "> ptrace_read(pid, map_addr, map, sizeof(struct link_map));<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> <br .="word-wrap: break-word; "> free(ehdr);<br .="word-wrap: break-word; "> free(phdr);<br .="word-wrap: break-word; "> free(dyn);<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> return map;<br .="word-wrap: break-word; ">}<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); ">void get_sym_info(int pid, struct link_map lm)<br .="word-wrap: break-word; ">{<br .="word-wrap: break-word; "> Elf32_Dyn dyn = (Elf32_Dyn ) malloc(sizeof(Elf32_Dyn));<br .="word-wrap: break-word; "> unsigned long dyn_addr;<br .="word-wrap: break-word; "> int ret;<div data-find="_1" .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> dyn_addr = (unsigned long)lm->l_ld;<br .="word-wrap: break-word; "> <br .="word-wrap: break-word; "> ptrace_read(pid, dyn_addr, dyn, sizeof(Elf32_Dyn));<br .="word-wrap: break-word; "> while(dyn->d_tag != DT_NULL){<br .="word-wrap: break-word; "> switch(dyn->d_tag)<br .="word-wrap: break-word; "> {<br .="word-wrap: break-word; "> case DT_SYMTAB:<br .="word-wrap: break-word; "> symtab = dyn->d_un.d_ptr;<br .="word-wrap: break-word; "> //puts("DT_SYMTAB");<br .="word-wrap: break-word; "> break;<br .="word-wrap: break-word; "> case DT_STRTAB:<br .="word-wrap: break-word; "> strtab = dyn->d_un.d_ptr;<br .="word-wrap: break-word; "> //puts("DT_STRTAB");<br .="word-wrap: break-word; "> break;<br .="word-wrap: break-word; "> case DT_HASH:<br .="word-wrap: break-word; "> nchains = 0;<br .="word-wrap: break-word; ">// ptrace_read(pid, dyn->d_un.d_ptr + lm->l_addr + 4,&nchains, sizeof(nchains));<br .="word-wrap: break-word; "> ptrace_read(pid, dyn->d_un.d_ptr + 4,&nchains, sizeof(nchains));<br .="word-wrap: break-word; "> //puts("DT_HASH");<br .="word-wrap: break-word; "> break;<br .="word-wrap: break-word; "> case DT_JMPREL:<br .="word-wrap: break-word; "> jmprel = dyn->d_un.d_ptr;<br .="word-wrap: break-word; "> //puts("DT_JMPREL");<br .="word-wrap: break-word; "> break;<br .="word-wrap: break-word; "> case DT_PLTRELSZ:<br .="word-wrap: break-word; "> //puts("DT_PLTRELSZ");<br .="word-wrap: break-word; "> totalrelsize = dyn->d_un.d_val;<br .="word-wrap: break-word; "> break;<br .="word-wrap: break-word; "> case DT_RELAENT:<br .="word-wrap: break-word; "> relsize = dyn->d_un.d_val;<br .="word-wrap: break-word; "> //puts("DT_RELAENT");<br .="word-wrap: break-word; "> break;<br .="word-wrap: break-word; "> case DT_RELENT:<br .="word-wrap: break-word; "> relsize = dyn->d_un.d_val;<br .="word-wrap: break-word; "> //puts("DT_RELENT");<br .="word-wrap: break-word; "> break;<br .="word-wrap: break-word; "> }<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> ptrace_read(pid, dyn_addr += sizeof(Elf32_Dyn), dyn, sizeof(Elf32_Dyn));<br .="word-wrap: break-word; "> }<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> nrels = totalrelsize / relsize;<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> free(dyn);<br .="word-wrap: break-word; ">}<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); ">unsigned long find_symbol_in_linkmap(int pid, struct link_map lm, char sym_name)<br .="word-wrap: break-word; ">{<br .="word-wrap: break-word; "> Elf32_Sym sym = (Elf32_Sym ) malloc(sizeof(Elf32_Sym));<br .="word-wrap: break-word; "> int i;<br .="word-wrap: break-word; "> char str;<br .="word-wrap: break-word; "> unsigned long ret;<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> get_sym_info(pid, lm);<br .="word-wrap: break-word; "> if(nchains<0) printf("nchains=\n",nchains);<br .="word-wrap: break-word; "> <br .="word-wrap: break-word; "> for(i = 0; i < nchains; i++) {<br .="word-wrap: break-word; "> ptrace_read(pid, symtab + i sizeof(Elf32_Sym), sym, sizeof(Elf32_Sym));<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> if (!sym->st_name || !sym->st_size || !sym->st_value)<br .="word-wrap: break-word; "> continue;<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> str = (char ) ptrace_readstr(pid, strtab + sym->st_name);<br .="word-wrap: break-word; "> if (strcmp(str, sym_name) == 0) {<br .="word-wrap: break-word; "> free(str);<br .="word-wrap: break-word; "> str = ptrace_readstr(pid, (unsigned long)lm->l_name);<br .="word-wrap: break-word; "> printf("lib name [%s]\n", str);<br .="word-wrap: break-word; "> free(str);<br .="word-wrap: break-word; "> break;<br .="word-wrap: break-word; "> }<br .="word-wrap: break-word; "> free(str);<br .="word-wrap: break-word; "> }<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "><br .="word-wrap: break-word; "> if (i == nchains)<br .="word-wrap: break-word; "> ret = 0;<br .="word-wrap: break-word; "> else<br .="word-wrap: break-word; "> ret = lm->l_addr + sym->st_value;<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> free(sym);<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> return ret;<br .="word-wrap: break-word; ">}<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); ">unsigned long find_symbol(int pid, struct link_map map, char sym_name)<br .="word-wrap: break-word; ">{<br .="word-wrap: break-word; "> struct link_map lm = (struct link_map ) malloc(sizeof(struct link_map));<br .="word-wrap: break-word; "> unsigned long sym_addr;<br .="word-wrap: break-word; "> char str;<br .="word-wrap: break-word; "> <br .="word-wrap: break-word; "> sym_addr = find_symbol_in_linkmap(pid, map, sym_name);<br .="word-wrap: break-word; "> if (sym_addr)<br .="word-wrap: break-word; "> return sym_addr;<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> if (!map->l_next) return 0;<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> ptrace_read(pid, (unsigned long)map->l_next, lm, sizeof(struct link_map));<br .="word-wrap: break-word; "> sym_addr = find_symbol_in_linkmap(pid, lm, sym_name);<br .="word-wrap: break-word; "> while(!sym_addr && lm->l_next) {<br .="word-wrap: break-word; "> ptrace_read(pid, (unsigned long)lm->l_next, lm, sizeof(struct link_map));<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> str = ptrace_readstr(pid, (unsigned long)lm->l_name);<br .="word-wrap: break-word; "> if(str[0] == '\0')<br .="word-wrap: break-word; "> continue;<br .="word-wrap: break-word; "> printf("[%s]\n", str);<br .="word-wrap: break-word; "> free(str);<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> if ((sym_addr = find_symbol_in_linkmap(pid, lm, sym_name)))<br .="word-wrap: break-word; "> break;<br .="word-wrap: break-word; "> }<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> return sym_addr;<br .="word-wrap: break-word; ">}<br .="word-wrap: break-word; ">void get_dyn_info(int pid);<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); ">unsigned long find_sym_in_rel(int pid, char sym_name)<br .="word-wrap: break-word; ">{<br .="word-wrap: break-word; "> Elf32_Rel rel = (Elf32_Rel ) malloc(sizeof(Elf32_Rel));<br .="word-wrap: break-word; "> Elf32_Sym sym = (Elf32_Sym ) malloc(sizeof(Elf32_Sym));<br .="word-wrap: break-word; "> int i;<br .="word-wrap: break-word; "> char str;<br .="word-wrap: break-word; "> unsigned long ret;<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> get_dyn_info(pid);<br .="word-wrap: break-word; "> for(i = 0; i< nrels ;i++) {<br .="word-wrap: break-word; "> ptrace_read(pid, (unsigned long)(jmprel + i sizeof(Elf32_Rel)),<br .="word-wrap: break-word; "> rel, sizeof(Elf32_Rel));<br .="word-wrap: break-word; "> if(ELF32_R_SYM(rel->r_info)) {<br .="word-wrap: break-word; "> ptrace_read(pid, symtab + ELF32_R_SYM(rel->r_info) <br .="word-wrap: break-word; "> sizeof(Elf32_Sym), sym, sizeof(Elf32_Sym));<br .="word-wrap: break-word; "> str = ptrace_readstr(pid, strtab + sym->st_name);<br .="word-wrap: break-word; "> if (strcmp(str, sym_name) == 0) {<br .="word-wrap: break-word; "> free(str);<br .="word-wrap: break-word; "> break;<br .="word-wrap: break-word; "> }<br .="word-wrap: break-word; "> free(str);<br .="word-wrap: break-word; "> }<br .="word-wrap: break-word; "> }<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> if (i == nrels)<br .="word-wrap: break-word; "> ret = 0;<br .="word-wrap: break-word; "> else<br .="word-wrap: break-word; "> ret = rel->r_offset;<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> free(rel);<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> return ret;<br .="word-wrap: break-word; ">}<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); ">void get_dyn_info(int pid)<br .="word-wrap: break-word; ">{<br .="word-wrap: break-word; "> Elf32_Dyn dyn = (Elf32_Dyn ) malloc(sizeof(Elf32_Dyn));<br .="word-wrap: break-word; "> int i = 0;<div data-find="_11" .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> ptrace_read(pid, dyn_addr + i sizeof(Elf32_Dyn), dyn, sizeof(Elf32_Dyn));<br .="word-wrap: break-word; "> i++;<br .="word-wrap: break-word; "> while(dyn->d_tag){<br .="word-wrap: break-word; "> switch(dyn->d_tag)<br .="word-wrap: break-word; "> {<br .="word-wrap: break-word; "> case DT_SYMTAB:<br .="word-wrap: break-word; "> puts("DT_SYMTAB");<br .="word-wrap: break-word; "> symtab = dyn->d_un.d_ptr;<br .="word-wrap: break-word; "> break;<br .="word-wrap: break-word; "> case DT_STRTAB:<br .="word-wrap: break-word; "> strtab = dyn->d_un.d_ptr;<br .="word-wrap: break-word; "> //puts("DT_STRTAB");<br .="word-wrap: break-word; "> break;<br .="word-wrap: break-word; "> case DT_JMPREL:<br .="word-wrap: break-word; "> jmprel = dyn->d_un.d_ptr;<br .="word-wrap: break-word; "> //puts("DT_JMPREL");<br .="word-wrap: break-word; "> printf("jmprel\t %p\n", jmprel);<br .="word-wrap: break-word; "> break;<br .="word-wrap: break-word; "> case DT_PLTRELSZ:<br .="word-wrap: break-word; "> totalrelsize = dyn->d_un.d_val;<br .="word-wrap: break-word; "> //puts("DT_PLTRELSZ");<br .="word-wrap: break-word; "> break;<br .="word-wrap: break-word; "> case DT_RELAENT:<br .="word-wrap: break-word; "> relsize = dyn->d_un.d_val;<br .="word-wrap: break-word; "> //puts("DT_RELAENT");<br .="word-wrap: break-word; "> break;<br .="word-wrap: break-word; "> case DT_RELENT:<br .="word-wrap: break-word; "> relsize = dyn->d_un.d_val;<br .="word-wrap: break-word; "> //puts("DT_RELENT");<br .="word-wrap: break-word; "> break;<br .="word-wrap: break-word; "> }<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> ptrace_read(pid, dyn_addr + i sizeof(Elf32_Dyn), dyn, sizeof(Elf32_Dyn));<br .="word-wrap: break-word; "> i++;<br .="word-wrap: break-word; "> }<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> nrels = totalrelsize / relsize;<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> free(dyn);<br .="word-wrap: break-word; ">}<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); ">void call_dl_open(int pid, unsigned long addr, char libname)<br .="word-wrap: break-word; ">{<br .="word-wrap: break-word; "> void pRLibName;<br .="word-wrap: break-word; "> struct user_regs_struct regs;<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> pRLibName = ptrace_push(pid, libname, strlen(libname) + 1);<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> ptrace_readreg(pid, &regs);<br .="word-wrap: break-word; "> regs.eax = (unsigned long) pRLibName;<br .="word-wrap: break-word; "> regs.ecx = 0x0;<br .="word-wrap: break-word; "> regs.edx = RTLD_LAZY;<br .="word-wrap: break-word; "> ptrace_writereg(pid, &regs);<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> ptrace_call(pid, addr);<br .="word-wrap: break-word; "> puts("call _dl_open ok");<br .="word-wrap: break-word; ">}<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); ">void call_mtrace(int pid,unsigned long addr)<br .="word-wrap: break-word; ">{<br .="word-wrap: break-word; "> ptrace_call(pid, addr);<br .="word-wrap: break-word; "> puts("call mtrace ok");<br .="word-wrap: break-word; ">}<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); ">int main(int argc, char argv[])<br .="word-wrap: break-word; ">{<br .="word-wrap: break-word; "> int pid;<br .="word-wrap: break-word; "> struct link_map map;<br .="word-wrap: break-word; "> char sym_name[256];<br .="word-wrap: break-word; "> unsigned long sym_addr;<br .="word-wrap: break-word; "> unsigned long new_addr,old_addr,rel_addr;<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); ">/ if((pid = fork())<0)<br .="word-wrap: break-word; "> {<br .="word-wrap: break-word; "> printf("fork is error\n");<br .="word-wrap: break-word; "> return 0;<br .="word-wrap: break-word; "> }else if(pid == 0)<br .="word-wrap: break-word; "> {<br .="word-wrap: break-word; "> ptrace(PTRACE_TRACEME, 0, NULL, NULL);<br .="word-wrap: break-word; "> execl("/home/e11963/szw/hello/hello","hello",NULL);<br .="word-wrap: break-word; "> exit(0);<br .="word-wrap: break-word; "> }<br .="word-wrap: break-word; "> <br .="word-wrap: break-word; "> waitpid(pid, NULL, WUNTRACED); <br .="word-wrap: break-word; "> <br .="word-wrap: break-word; "> ptrace_readreg(pid, &oldregs);<br .="word-wrap: break-word; ">/<br .="word-wrap: break-word; "> pid = atoi(argv[1]);<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> / ??????? /<br .="word-wrap: break-word; "> ptrace_attach(pid);<br .="word-wrap: break-word; "> map = get_linkmap(pid); <div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); ">// sym_addr = find_symbol(pid, map, "_dl_open"); / call _dl_open /<br .="word-wrap: break-word; ">// printf("found _dl_open at addr %p\n", sym_addr); <br .="word-wrap: break-word; ">// call_dl_open(pid, sym_addr, "/lib/i686/libc-2.3.2.so"); / ???????? / <br .="word-wrap: break-word; "> <br .="word-wrap: break-word; "> strcpy(sym_name, "mtrace"); / intercept /<br .="word-wrap: break-word; "> sym_addr = find_symbol(pid, map, sym_name);<br .="word-wrap: break-word; "> printf("%s addr\t %p\n", sym_name, sym_addr);<br .="word-wrap: break-word; "> call_mtrace(pid,sym_addr);<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> ptrace_detach(pid);<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> exit(0);<br .="word-wrap: break-word; ">}<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); "> <div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); ">测试程序<div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); ">#include <stdio.h><br .="word-wrap: break-word; ">#include <mcheck.h><br .="word-wrap: break-word; ">#include <unistd.h><br .="word-wrap: break-word; ">#include <sys/types.h><div .="word-wrap: break-word; color: rgb(102, 102, 102); font-family: 宋体, Arial; font-size: 12px; line-height: 26px; background-color: rgb(255, 255, 255); ">int main(void)<br .="word-wrap: break-word; ">{<br .="word-wrap: break-word; "> pid_t pid=getpid();<br .="word-wrap: break-word; "> printf("pid=%d\n",pid);<br .="word-wrap: break-word; "> sleep(200);<br .="word-wrap: break-word; "> <br .="word-wrap: break-word; "> printf("asdfasdfsdf\n");<br .="word-wrap: break-word; "> char p=(char*)malloc(10);<br .="word-wrap: break-word; "> malloc(20);<br .="word-wrap: break-word; "> free(p);<br .="word-wrap: break-word; "> <br .="word-wrap: break-word; "> return 0;<br .="word-wrap: break-word; ">}