https://github.com/anfractuosity/procmod

Modifies running processes on Linux
https://github.com/anfractuosity/procmod

ptrace ptrace-injection reverse-engineering

Last synced: 2 months ago
JSON representation

Modifies running processes on Linux

• Host: GitHub
• URL: https://github.com/anfractuosity/procmod
• Owner: anfractuosity
• Created: 2012-11-02T23:50:16.000Z (about 12 years ago)
• Default Branch: master
• Last Pushed: 2022-06-26T16:25:10.000Z (over 2 years ago)
• Last Synced: 2024-05-21T06:28:13.684Z (8 months ago)
• Topics: ptrace, ptrace-injection, reverse-engineering
• Language: C
• Homepage: https://www.anfractuosity.com/projects/procmod/
• Size: 27.3 KB
• Stars: 24
• Watchers: 12
• Forks: 3
• Open Issues: 1
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

        
# ProcMod v0.1

## About

Modifies running processes on linux.

* Finds ASCII/UTF-16/binary and replaces it appropiately

* Dumps processes to disk

## Compilation

Should compile fine on 32/64 bit architectures, simply by typing 'make'.

## Arguments 

* -p PROCID - Process ID to work on

* -f        - Text to find in the process

* -r        - Text to replace in the proces

* -u        - Convert find/replace parameters to UTF-16 (for JVM)

* -d FILE   - dumps process to file

* -l NUM    - Lower bound of search

* -t NUM    - Top bound of search

* -h        - Hexadecimal find/replace strings

## Example usage

Search for the text HELLOWORLD in a firefox process, from the hex address 0x00007fef32000000.

./procmod -p `pgrep firefox` -f HELLOWORLD -l `printf "%u" 0x00007fef32000000`

Find the hexadecimal bytes 0xDEADBEEF in firefox.

./procmod -p `pgrep firefox` -f "DEADBEEF" -h

## Problems

If you find it can't attach to a process, this could be because the process

is running as a different user.  The ptrace system call can only trace your own processes.

If you're running a Grsecurity kernel with "Configuration option: CONFIG_GRKERNSEC_PROC_MEMMAP" enabled

then you will find that most of the addresses in /proc/PROCESSID/maps are null.  This is because:

"If you say Y here, the /proc//maps and /proc//stat files will give no information about the addresses of its mappings if PaX features that rely on random addresses are enabled on the task. If you use PaX it is greatly recommended that you say Y here as it closes up a hole that makes the full ALSR useless for suid binaries."

## Usage 

Please see https://www.anfractuosity.com/projects/procmod/ for a simple example modifying a Java program.

## Licence

Licenced under GPL v2