{"id":176,"date":"2020-11-23T20:13:26","date_gmt":"2020-11-23T12:13:26","guid":{"rendered":"http:\/\/pareto.fun\/?p=176"},"modified":"2023-03-07T19:47:11","modified_gmt":"2023-03-07T11:47:11","slug":"%e5%86%85%e5%ad%98%e4%bf%ae%e6%94%b9%e5%ae%9e%e7%8e%b0%e9%9d%9eptrace%e4%b8%8e%e6%a3%80%e6%b5%8b","status":"publish","type":"post","link":"http:\/\/pareto.fun\/?p=176","title":{"rendered":"\u5185\u5b58\u4fee\u6539\u5b9e\u73b0(\u975eptrace)\u4e0e\u68c0\u6d4b"},"content":{"rendered":"\n

\u5185\u5b58\u4fee\u6539\u5b9e\u73b0<\/h1>\n\n\n\n

Env<\/h2>\n\n\n\n

ubuntu18<\/p>\n\n\n\n

introduction<\/h2>\n\n\n\n

\u505a\u53cd\u5916\u6302\u65f6\uff0c \u53d1\u73b0\u5f00\u542f\u8fdb\u7a0b\u81ea\u4fdd\u62a4\u540e\uff0cGG\u4fee\u6539\u5668\u540c\u6837\u53ef\u4ee5\u5bf9\u5e94\u7528\u7684\u5185\u5b58\u8fdb\u884c\u626b\u63cf\u548c\u4fee\u6539 \uff0c\u5224\u65ad\u4fee\u6539\u5668\u5e76\u975e\u4f7f\u7528ptrace\u5b8c\u6210\u5185\u5b58\u4fee\u6539\u64cd\u4f5c, \u6240\u4ee5\u5f15\u5165\u4e24\u4e00\u79cd\u5185\u5b58\u4fee\u6539\u7684\u65b9\u6cd5\u3002<\/p>\n\n\n\n

proc\/[pid]\/mem<\/h2>\n\n\n\n

Linux manual page \u5bf9\/proc \u76ee\u5f55\u7684\u4ecb\u7ecd\uff0c<\/p>\n\n\n\n

The proc filesystem is a pseudo-filesystem which provides an interface to kernel data structures.  It is commonly mounted at \/proc.  Typically, it is mounted automatically by the system,<\/pre>\n\n\n\n
\u5176\u4e2d\u6709\u4e2a\u7279\u6b8a\u7684\u76ee\u5f55\/proc\/[pid]\/mem\u3002<\/p>\n\n\n\n
This file can be used to access the pages of a process's memory through open(2), read(2), and lseek(2).
Permission to access this file is governed by a ptrace access mode PTRACE_MODE_ATTACH_FSCREDS check; see ptrace(2).<\/pre>\n\n\n\n
\u6211\u4eec\u53ef\u4ee5\u901a\u8fc7\u8bbf\u95ee\u8fd9\u4e2a\u6587\u4ef6\u6765\u8bbf\u95ee\u76f8\u5e94\u8fdb\u7a0b\u7684\u5185\u5b58\u7a7a\u95f4\uff0c\u5e76\u4e14\u901a\u8fc7\u4fee\u6539\u6587\u4ef6\u76f8\u5e94\u504f\u79fb\u7684\u6570\u636e\u6765\u5b9e\u73b0\u6309\u76f8\u5e94\u8fdb\u7a0b\u7a7a\u95f4\u7684\u6570\u636e\u3002<\/p>\n\n\n\n
<\/p>\n\n\n\n
process_vm_readv\/writev<\/h2>\n\n\n\n
https:\/\/man7.org\/linux\/man-pages\/man2\/process_vm_readv.2.html<\/a> , \u5b98\u65b9\u4ecb\u7ecd\u3002<\/p>\n\n\n\n
\u4f46\u662f\u8be5\u63a5\u53e3\u53d7\u8fdb\u7a0b\u9875\u6743\u9650\u7ba1\u7406\u3002\u4e0d\u53ef\u5199\u7684\u5185\u5b58\uff0c\u4e0d\u80fd\u901a\u8fc7process_vm_writev\u5199\u5165\uff0c\u540c\u7406readv\u3002<\/p>\n\n\n\n
experience<\/h2>\n\n\n\n
\u5f85\u4fee\u6539\u7a0b\u5e8f\u6e90\u7801, \u8f93\u51fa\u5f53\u524d\u8fdb\u7a0bpid \uff0c \u7a7a\u95f4\u5730\u5740\u548c\u5176\u4e2d\u7684\u5b57\u7b26\u4e32\u3002<\/p>\n\n\n\n
#include <stdio.h>
int main(void){
  char buf[200] = {\"mcl hello world 123 \"};
  while (1)
  {
    \/* code *\/
    printf(\"pid = %d , buf addr: %p , value = %s\\n\", getpid() , &buf , buf);
    sleep(5);
  }
  
  return 0;
}<\/pre>\n\n\n\n
\u5185\u5b58\u4fee\u6539\u5668\u4ee3\u7801<\/p>\n\n\n\n
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <error.h>
#include <errno.h>
#include <sys\/types.h> 
#include <sys\/stat.h>    
#include <fcntl.h>
int main(int argc , char ** argv){
  char buffer[50];
  char * despath = (char * )malloc( sizeof(char)*( sizeof(argv[1]) + sizeof(\"\/proc\/\/mem\")) );
  sprintf(despath , \"\/proc\/%s\/mem\",argv[1]);
  printf(\"despath %s\\n\" , despath);
\u200b
  long long offset = 0x7fff660fb9b0;
  printf(\"offset %p\\n\" , offset);
  int file = open(despath , O_RDWR  );
  if(file <= 0){
    printf(\"fopen error %s\\n\",strerror(errno));
    exit(0);
  }
  else
    printf(\"fopen succuessful\\n\");
  
  int err;
  printf(\"lseek %d\\n\" ,file);
  if(lseek(file , offset ,SEEK_SET) == -1){
    printf(\"fseek error %s \\n\" ,strerror(errno));
  }
\u200b
  int lenth;
  if(( lenth = read(file , buffer , sizeof(buffer)) )> 0 )
    printf(\"buffer %s \\n\" , buffer);
  else
  {
    printf(\"lenth %d\\n\" , lenth);
  }
  lseek(file , offset ,SEEK_SET);
  write(file , \"you must be changed  one more time\\n\" , sizeof(\"you must be changed  one more time\\n\"));
  close(file);
  return 0;
}<\/pre>\n\n\n\n
\u8fd0\u884c\u4e24\u4e2a\u7a0b\u5e8f\uff1a<\/p>\n\n\n\n
\"image-20201123194959830\"<\/figure>\n\n\n\n
\u68c0\u6d4b<\/h1>\n\n\n\n
inotify\u673a\u5236<\/h2>\n\n\n\n
monitoring filesystem events<\/pre>\n\n\n\n
\u8be5\u673a\u5236\u63d0\u4f9b\u5bf9\u6587\u4ef6\u7cfb\u7edf\u7684\u76d1\u63a7\uff0c\u5305\u62ec\u4f46\u4e0d\u9650\u4e8e \u4fee\u6539 \uff0c \u8bbf\u95ee \uff0c \u6253\u5f00\uff0c\u5173\u95ed \uff0c\u79fb\u52a8\u3002<\/p>\n\n\n\n
inotify \u673a\u5236\u66f4\u591a\u76f8\u5173\u5185\u5bb9\u53c2\u89c1reference\u3002<\/p>\n\n\n\n
\u68c0\u6d4b\u4ee3\u7801<\/p>\n\n\n\n
#include <errno.h>
#include <poll.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys\/inotify.h>
#include <unistd.h>
#include <string.h>
#include <sys\/time.h>
#include <sys\/types.h>
int main(int argc , char ** argv){
  char buf[4096];
  int fd  = inotify_init();
  int ret;
  int PID  = atoi(argv[1]);
  char * memmappath = (char *)malloc(sizeof(char) * ( sizeof(int)+sizeof(\"\/proc\/\/pagemap\") ) );
  char * mempath = (char *)malloc(sizeof(char) * ( sizeof(int) + sizeof(\"\/proc\/\/mem\") ) );
  fd_set readfds;
  FD_ZERO(&readfds);
  FD_SET(fd,&readfds);
\u200b
  sprintf(memmappath , \"\/proc\/%d\/pagemap\" ,PID);
  sprintf(mempath , \"\/proc\/%d\/mem\",PID);
  printf(\"mempath %s\\n\",mempath);
  printf(\"memmappath %s \\n\",memmappath);
\u200b
  inotify_add_watch(fd,memmappath,IN_ALL_EVENTS);
  inotify_add_watch(fd,mempath,IN_ALL_EVENTS);
\u200b
  for(;;){
    ret = select(fd + 1, &readfds, 0, 0, 0);
    if(ret){
      int length = read(fd, buf ,4096);
      for(int i = 0 ; i < length ; i+=sizeof(struct inotify_event))
      {
        struct inotify_event * e = (struct inotify_event *)&buf[i];
        printf(\"%s [%d] be touch %x\\n\", e->name, e->len, e->mask);
      }
        
    }
  }
  return 0;
}<\/pre>\n\n\n\n
\u6d4b\u8bd5\u6548\u679c\uff1a<\/p>\n\n\n\n
\"image-20201123200610466\"<\/figure>\n\n\n\n
https:\/\/man7.org\/linux\/man-pages\/man5\/proc.5.html<\/a> Linux manual page<\/p>
https:\/\/man7.org\/linux\/man-pages\/man7\/inotify.7.html<\/a> inotify\u76f8\u5173<\/p><\/blockquote>\n","protected":false},"excerpt":{"rendered":"
\u5185\u5b58\u4fee\u6539\u5b9e\u73b0 Env ubuntu18 introduction \u505a\u53cd\u5916\u6302\u65f6\uff0c \u53d1\u73b0\u5f00\u542f\u8fdb\u7a0b\u81ea\u4fdd\u62a4\u540e […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[9],"tags":[],"_links":{"self":[{"href":"http:\/\/pareto.fun\/index.php?rest_route=\/wp\/v2\/posts\/176"}],"collection":[{"href":"http:\/\/pareto.fun\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/pareto.fun\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/pareto.fun\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/pareto.fun\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=176"}],"version-history":[{"count":2,"href":"http:\/\/pareto.fun\/index.php?rest_route=\/wp\/v2\/posts\/176\/revisions"}],"predecessor-version":[{"id":512,"href":"http:\/\/pareto.fun\/index.php?rest_route=\/wp\/v2\/posts\/176\/revisions\/512"}],"wp:attachment":[{"href":"http:\/\/pareto.fun\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=176"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/pareto.fun\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=176"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/pareto.fun\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=176"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}