targeted injection on Linux via ptrace

[derekbruening]

From [email protected] on February 24, 2009 09:59:58

we should implement targeted injection a la drinject on Linux, via ptrace,
as an alternative when LD_PRELOAD is unavailable (due to security policies)

Original issue: http://code.google.com/p/dynamorio/issues/detail?id=37

[derekbruening]

From [email protected] on February 24, 2009 07:00:15

this was PR 248204

[derekbruening]

From [email protected] on December 03, 2012 10:49:44

I've implemented most of the pieces of this over a series of weekends. I've been working on it off and on, so it hasn't been reviewed incrementally.

Here's an outline of the approach. Now that we're libc independent ( issue #46 ) and can do early injection ( issue #47 ), libdynamorio.so doesn't need to be relocated, so long as it's loaded at its preferred base. That makes injection really easy, so long as the preferred base is open. We just need to execute the right mmap() and mprotect() syscalls.

ptrace provides a way to read and write registers and memory, but it doesn't provide a way to execute syscalls in the traced process. We can build syscall execution with those primitives, though. In the injector, I wrote some code that uses DR's standalone decoder to encode some code snippets that execute a single syscall and then break. With ptrace, we can insert the code into the process, run it, regain control, and then put back the original code and registers.

Using that, I built up injectee_map_file(), injectee_prot(), and injectee_unmap() primitives that I could use with our private loader. We can call into our private loader with these function pointers, and it will map DR into the injectee.

Once we've done that, we can push the initial mcontext and other takeover data onto the app's current stack and go to a takeover PC somewhere in DR. For now I'm using _start in x86.asm since it's easy to find in the ELF header and it already sets up a real stack frame.

Owner: [email protected]

[derekbruening]

From [email protected] on March 12, 2013 06:46:23

Moved from https://code.google.com/p/dynamorio/issues/detail?id=38#c5 Testing on modern distros is made more difficult by the ptrace_scope stuff that's been done recently. I want to add a test for attach, but I don't want to require devs to set /proc/sys/kernel/yama/ptrace_scope to 0 in order to get the test to pass.

The new restrictions say that you can only ptrace a child process. I think I can adequately test our injection if I do the following:

• master process: fork+execve injector
• injector process: fork+execve app
• injector process: wait for app to do something interesting
• injector process: execve drrun -attach
• master process: wait on injector, wait on app (can't waitpid on grandchild, need a pipe or file)