1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
| #define _GNU_SOURCE
#include <sys/uio.h>
#include <sys/types.h>
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>
#include <signal.h>
int main(int argc, char *argv[]) {
if (argc != 2) {
fprintf(stderr, "Usage: %s <target_pid>\n", argv[0]);
exit(1);
}
pid_t target_pid = atoi(argv[1]);
struct iovec local_iov[2];
struct iovec remote_iov[2];
ssize_t result;
int local_int;
char local_string[256];
int new_int = 99999;
char new_string[] = "Modified by accessor process!";
printf("Accessing process PID: %d\n", getpid());
printf("Target PID: %d\n", target_pid);
// 读取远程进程内存
printf("\n--- Reading remote memory ---\n");
local_iov[0].iov_base = &local_int;
local_iov[0].iov_len = sizeof(local_int);
local_iov[1].iov_base = local_string;
local_iov[1].iov_len = sizeof(local_string);
// 注意：这里需要知道目标进程的确切内存地址
// 在实际应用中，这些地址需要通过调试信息或其他方式获取
remote_iov[0].iov_base = (void*)0x601040; // 需要根据实际情况调整
remote_iov[0].iov_len = sizeof(int);
remote_iov[1].iov_base = (void*)0x601060; // 需要根据实际情况调整
remote_iov[1].iov_len = sizeof(local_string);
result = process_vm_readv(target_pid,
local_iov, 2,
remote_iov, 2,
0);
if (result == -1) {
perror("process_vm_readv");
printf("Note: You need to adjust memory addresses based on target process\n");
return 1;
}
printf("Read %zd bytes\n", result);
printf("Remote int value: %d\n", local_int);
printf("Remote string: %s\n", local_string);
// 修改远程进程内存
printf("\n--- Writing to remote memory ---\n");
local_iov[0].iov_base = &new_int;
local_iov[0].iov_len = sizeof(new_int);
local_iov[1].iov_base = new_string;
local_iov[1].iov_len = strlen(new_string) + 1;
result = process_vm_writev(target_pid,
local_iov, 2,
remote_iov, 2,
0);
if (result == -1) {
perror("process_vm_writev");
return 1;
}
printf("Wrote %zd bytes to remote process\n", result);
// 再次读取验证修改
printf("\n--- Verifying changes ---\n");
result = process_vm_readv(target_pid,
local_iov, 2,
remote_iov, 2,
0);
if (result != -1) {
printf("Remote int value after write: %d\n", local_int);
printf("Remote string after write: %s\n", local_string);
}
// 发送信号给目标进程
printf("\n--- Sending signal to target process ---\n");
if (kill(target_pid, SIGUSR1) == -1) {
perror("kill");
} else {
printf("Signal sent successfully\n");
}
return 0;
}
|