Skip to content
Snippets Groups Projects
Commit 2f7dc334 authored by Christian Dietrich's avatar Christian Dietrich
Browse files

Dec 20 -- Don't Dip Your Fingers into the Sauce!

Article:  https://ibr.cs.tu-bs.de/advent/20-vmreadv/
Workload: ~52 source-code lines
parent 3418afa4
No related branches found
No related tags found
No related merge requests found
PROG = poke
${PROG}: ${PROG}.c
gcc $< -o $@ -Wall -g -O3 `pkg-config --cflags python3`
run: ${PROG}
python3 test.py
strace: ${PROG}
python3 test.py strace -e trace='process_vm_readv,process_vm_writev'
clean:
rm -f ./${PROG}
#define _GNU_SOURCE
#include <sys/uio.h>
#include <string.h>
#include <errno.h>
#include <stdlib.h>
#include <stdio.h>
#include <stdint.h>
#include <Python.h>
#define die(msg) do { perror(msg); exit(EXIT_FAILURE); } while(0)
// Read memory from pid's memory, starting at ptr and len bytes.
// Returns an heap-allocated buffer
void *peek(pid_t pid, const void *ptr, size_t len) {
// FIXME: process_vm_readv(2)
return NULL;
}
// Copy memory from this process to the remote process (pid).
// Remote Address: ptr
// Local Address: buffer
// Length: len
void poke(pid_t pid, void *ptr, void *buffer, size_t len) {
// FIXME: process_vm_writev(2)
}
int main(int argc, char* argv[]) {
if (argc != 3) {
fprintf(stderr, "usage: %s PID ADDR\n", argv[0]);
return -1;
}
pid_t pid = atoi(argv[1]); (void)pid;
void *ptr;
int n = sscanf(argv[2], "0x%p", &ptr);
if (n != 1) die("sscanf");
// FIXME: Read the PyObject obj in remote process (pid, ptr)
// FIXME: Extract the type name (Py_TYPE(obj)->tp_name
// FIXME: If "float" PyFloatObject: square ob_fvalue
// FIXME: If "int" PyLongObject: set the lowest 2 bytes to 0xabba
// Example output of make run (two invocations of poke):
// pointers ['0x7f6050b5da90', '0x7f60507cd410', '0x7f60507cd410']
// objects ['0xdeadbeef', 23.0, 23.0]
// PyObject @ 0x7f6050b5da90: refcount=3, type=int
// PyLongObject: ob_digit[0] = 0x1eadbeef
// PyObject @ 0x7f60507cd410: refcount=4, type=float
// PyFloatObject: ob_fval=23.000000
// object ['0xdeadabba', 529.0, 529.0]
}
import sys
import os
import subprocess
I = 0xdeadbeef
D = 23.0
D2 = 23.0
print("pointers", [hex(id(I)), hex(id(D)), hex(id(D2))])
print("objects", [hex(I), D, D2])
subprocess.call(sys.argv[1:] + ["./poke", str(os.getpid()), hex(id(I))])
subprocess.call(sys.argv[1:] + ["./poke", str(os.getpid()), hex(id(D))])
print("object", [hex(I), D, D2])
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment