考虑这个简单的程序,它只是无限循环:
int main(void) {
for(;;);
}
使用ptrace
将系统调用注入进去非常简单,就像这样:
#include <stdio.h>
#include <stdlib.h>
#include <sys/ptrace.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/user.h>
#include <sys/wait.h>
int main(int argc, char *argv[]) {
struct user_regs_struct regs;
pid_t pid = strtol(argv[1], NULL, 10);
ptrace(PTRACE_ATTACH, pid, 0, 0);
waitid(P_PID, pid, NULL, WSTOPPED);
ptrace(PTRACE_GETREGS, pid, 0, ®s);
if(ptrace(PTRACE_POKETEXT, pid, (void*)regs.rip, (void*)0x050f /* the "syscall" instruction, in little-endian */)) {
perror("PTRACE_POKETEXT");
return 1;
}
regs.rax = SYS_exit;
regs.rdi = 42;
ptrace(PTRACE_SETREGS, pid, 0, ®s);
ptrace(PTRACE_DETACH, pid, 0, 0);
return 0;
}
这将在无限循环中注入系统调用_exit(42);
。也可以通过查找现有的syscall
指令来实现,而不是仅仅覆盖指令指针所在的位置。
现在考虑这个程序,在一些设置之后也只是无限循环:
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/mman.h>
#include <sys/syscall.h>
struct mapping_list {
void *start;
size_t len;
struct mapping_list *next;
};
typedef void unmap_all_t(struct mapping_list *list, void *start, size_t len);
extern unmap_all_t unmap_all;
extern const char unmap_all_end[];
__asm__("\n"
"unmap_all:\n"
" movq %rsi, %r8 # save start\n"
" movq %rdi, %r9 # save list\n"
".unmap_list_element:\n"
" movq (%r9), %rdi # pass list->start as addr\n"
" movq 8(%r9), %rsi # pass list->len as length\n"
" movl $11, %eax # SYS_munmap\n"
" syscall\n"
" movq 16(%r9), %r9 # advance to the next list element\n"
" testq %r9, %r9\n"
" jne .unmap_list_element\n"
" movl $11, %eax # SYS_munmap\n"
" movq %r8, %rdi # pass start as addr\n"
" movq %rdx, %rsi # pass len as length\n"
" jmp .final_syscall\n"
" .org unmap_all+4094 # make sure the upcoming syscall instruction is at the very end of the page,\n"
".final_syscall: # given that unmap_all started at the very beginning of it\n"
" syscall\n"
".loop_forever:\n"
" jmp .loop_forever\n"
"unmap_all_end:\n"
);
int main(void) {
FILE *maps = fopen("/proc/self/maps", "r");
if(!maps) {
perror("fopen");
return 1;
}
struct mapping_list *list = NULL;
unsigned long start, end;
char r, w, x;
while(fscanf(maps, "%lx-%lx %c%c%c", &start, &end, &r, &w, &x) == 5) {
while(fgetc(maps) != '\n');
if(x != 'x') continue;
struct mapping_list *new_list = malloc(sizeof(struct mapping_list));
new_list->start = (void*)start;
new_list->len = end - start;
new_list->next = list;
list = new_list;
}
if(fclose(maps)) {
perror("fclose");
return 1;
}
int memfd = syscall(SYS_memfd_create, "unmap_all", 2 /* MFD_ALLOW_SEALING */);
if(memfd == -1) {
perror("memfd_create");
return 1;
}
if(ftruncate(memfd, 8192)) {
perror("ftruncate");
return 1;
}
char *pages = mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_SHARED, memfd, 0);
if(pages == MAP_FAILED) {
perror("mmap");
return 1;
}
memcpy(pages, unmap_all, unmap_all_end - (const char*)unmap_all);
if(munmap(pages, 8192)) {
perror("munmap");
return 1;
}
char *path;
if(asprintf(&path, "/proc/self/fd/%d", memfd) == -1) {
perror("asprintf");
return 1;
}
int memfd_ro = open(path, O_RDONLY);
if(memfd_ro == -1) {
perror("open");
return 1;
}
free(path);
if(fcntl(memfd, 1033 /* F_ADD_SEALS */, 15 /* F_SEAL_SEAL|F_SEAL_SHRINK|F_SEAL_GROW|F_SEAL_WRITE */)) {
perror("fcntl");
return 1;
}
if(close(memfd)) {
perror("close");
return 1;
}
pages = mmap(NULL, 8192, PROT_READ|PROT_EXEC, MAP_SHARED, memfd_ro, 0);
if(pages == MAP_FAILED) {
perror("mmap");
return 1;
}
if(close(memfd_ro)) {
perror("close");
return 1;
}
((unmap_all_t*)pages)(list, pages, 4096);
__builtin_unreachable();
}
当我尝试在程序上使用ptrace时,使用PTRACE_POKETEXT步骤写入系统调用指令时会出现错误EIO,因为所包含的页面是只读文件的共享映射。我也没有找到现有syscall指令的选项,因为除了一个可执行页面之外的所有页面都已被取消映射,而唯一剩下的页面并不包含任何该指令。
是否有其他方法使用ptrace使该程序执行系统调用,或者我已经完全做不到了?(如果有关系,请假设是Linux 4.19在x86_64上。)
PTRACE_PEEKTEXT
、PTRACE_POKETEXT
、PTRACE_GETREGS
和PTRACE_SETREGS
来设置系统调用。之后,在实际注入的syscall
指令上执行PTRACE_SINGLESTEP
。然后,恢复所有内容。这里有一个帮助库:https://github.com/emptymonkey/ptrace_do,其中包含一些代码。请注意,您不需要查找现有的`syscall`,只需要在文本段中找到足够的空间来注入一个(例如两个字节就足够了)。 - Craig EsteyPROT_READ|PROT_EXEC
,MAP_PRIVATE|MAP_ANONYMOUS
页面? - Joseph Sible-Reinstate MonicaPTRACE_POKETEXT
能够写入可执行页面,那么它将违反F_SEAL_WRITE
提供的保证。 - Joseph Sible-Reinstate Monica