Inject custom code or data into running process

[Mike Krinkin]

On Tue, Jan 03, 2017 at 10:54:55PM +0300, Sayutin Dmitry wrote:
> This sounds like a solution, but it's a bit complicated one.
> 
> I would prefer to implement injection in kernel space, because it should be more simple.
> Thank you for your idea nevertheless =)

you are welcome, if you really want to implement injection in kernel
space (IMHO, i'm not sure that it would be easier), you can look at
here:

http://man7.org/linux/man-pages/man7/vdso.7.html

Kernel maps vdso in user space app memory (though it's possible to
disable vdso all together, AFAIK), so if you can add your injection
in vdso, kernel will map your code in an application address space.

> 
> 03.01.2017, 22:45, "Mike Krinkin" <krinkin.m.u at gmail.com>:
> > On Tue, Jan 03, 2017 at 10:24:11PM +0300, Sayutin Dmitry wrote:
> >>  Hello, how one should inject code or data into allready running process?
> >
> > If you have enough priviledges to use ptrace you can write in a target
> > process memory. Though, AFAIK, you can only overwrite existing memory and
> > can't create new mapping using ptrace, so in order to overcome this you
> > need to save original code first, rewrite it with your injection bootstrap
> > code (bootstrap code for example can load a shared library), execute it
> > and then return original code back.
> >
> >>  There is no need to start code execution at this point, but it should appear in it's virtual memory.
> >>
> >>  Moreover, i want this data to persist across execve's or clone's (probably can be implemented as hook on appropriate kernel methodes)
> >>
> >>  (If you want to know motivation for this -- I want to implement some new idea on sandboxing).
> >>
> >>  Thanks in advance, Sayutin Dmitry <cdkrot at yandex.ru>
> >>
> >>  _______________________________________________
> >>  Kernelnewbies mailing list
> >>  Kernelnewbies at kernelnewbies.org
> >>  https://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
> 
> ----- 
> Sayutin Dmitry <cdkrot at yandex.com>