我在Linux中玩ptrace。我正在尝试使用/ proc / pid / mem接口编写跟踪进程的内存。
我用来完成此任务的功能是:
void write_proc(pid_t child, unsigned long int addr) { char mem_file_name[100]; char buf[10]="hope"; int mem_fd; memset( (void*)mem_file_name, 0, 100); memset( (void *)buf, 0, 10); sprintf(mem_file_name, "/proc/%d/mem", child); mem_fd = open(mem_file_name, O_RDONLY); lseek(mem_fd, addr , SEEK_SET); if (write(mem_fd, buf, 5) < 0 ) perror("Writing"); return; }
但是我总是会得到错误:编写:错误的文件描述符。
是否可以使用此方法编写跟踪过程?
您正在以只读模式(O_RDONLY)打开文件。我建议O_RDWR改用:
O_RDONLY
O_RDWR
mem_fd = open(mem_file_name, O_RDWR);
但是,从man proc目前尚不清楚这是否可行:
man proc
/proc/[pid]/mem This file can be used to access the pages of a process's memory through open(2), read(2), and lseek(2).
/proc/[pid]/mem This file can be used to access the pages of a process's
memory through open(2), read(2), and lseek(2).
编辑:
我也很好奇,所以我ptrace()直接使用下面的示例:
ptrace()
#include <sys/ptrace.h> #include <unistd.h> #include <stdio.h> #include <stdlib.h> #include <stdint.h> #define SHOW(call) ({ int _ret = (int)(call); printf("%s -> %d\n", #call, _ret); if (_ret < 0) { perror(NULL); }}) char changeme[] = "This is a test"; int main (void) { pid_t pid = fork(); int ret; int i; union { char cdata[8]; int64_t data; } u = { "Hijacked" }; switch (pid) { case 0: /* child */ sleep(1); printf("Message: %s\n", changeme); exit(0); case -1: perror("fork"); exit(1); break; default: /* parent */ SHOW(ptrace(PTRACE_ATTACH, pid, 0, 0)); SHOW(ptrace(PTRACE_POKEDATA, pid, changeme, u.data)); SHOW(ptrace(PTRACE_CONT, pid, 0, 0)); wait(NULL); break; } return 0; }