• Linux hook 技术一个简单demo分析

    1. #include 
    2. #include 
    3.  
    4. int main(){
    5.     printf("the pid is %d\n",getpid());
    6.     return 0;
    7. }

    gcc -o gotTest main.c

    readelf -a gotTest

    可以得到如下结果：

    1. ELF 头：
    2.   Magic：   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 
    3.   类别:                              ELF64
    4.   数据:                              2 补码，小端序 (little endian)
    5.   Version:                           1 (current)
    6.   OS/ABI:                            UNIX - System V
    7.   ABI 版本:                          0
    8.   类型:                              DYN (共享目标文件)
    9.   系统架构:                          Advanced Micro Devices X86-64
    10.   版本:                              0x1
    11.   入口点地址：               0x1080
    12.   程序头起点：          64 (bytes into file)
    13.   Start of section headers:          14760 (bytes into file)
    14.   标志：             0x0
    15.   Size of this header:               64 (bytes)
    16.   Size of program headers:           56 (bytes)
    17.   Number of program headers:         13
    18.   Size of section headers:           64 (bytes)
    19.   Number of section headers:         31
    20.   Section header string table index: 30
    21.  
    22. 节头：
    23.   [号] 名称              类型             地址              偏移量
    24.        大小              全体大小          旗标   链接   信息   对齐
    25.   [ 0]                   NULL             0000000000000000  00000000
    26.        0000000000000000  0000000000000000           0     0     0
    27.   [ 1] .interp           PROGBITS         0000000000000318  00000318
    28.        000000000000001c  0000000000000000   A       0     0     1
    29.   [ 2] .note.gnu.propert NOTE             0000000000000338  00000338
    30.        0000000000000020  0000000000000000   A       0     0     8
    31.   [ 3] .note.gnu.build-i NOTE             0000000000000358  00000358
    32.        0000000000000024  0000000000000000   A       0     0     4
    33.   [ 4] .note.ABI-tag     NOTE             000000000000037c  0000037c
    34.        0000000000000020  0000000000000000   A       0     0     4
    35.   [ 5] .gnu.hash         GNU_HASH         00000000000003a0  000003a0
    36.        0000000000000024  0000000000000000   A       6     0     8
    37.   [ 6] .dynsym           DYNSYM           00000000000003c8  000003c8
    38.        00000000000000c0  0000000000000018   A       7     1     8
    39.   [ 7] .dynstr           STRTAB           0000000000000488  00000488
    40.        000000000000008b  0000000000000000   A       0     0     1
    41.   [ 8] .gnu.version      VERSYM           0000000000000514  00000514
    42.        0000000000000010  0000000000000002   A       6     0     2
    43.   [ 9] .gnu.version_r    VERNEED          0000000000000528  00000528
    44.        0000000000000020  0000000000000000   A       7     1     8
    45.   [10] .rela.dyn         RELA             0000000000000548  00000548
    46.        00000000000000c0  0000000000000018   A       6     0     8
    47.   [11] .rela.plt         RELA             0000000000000608  00000608
    48.        0000000000000030  0000000000000018  AI       6    24     8
    49.   [12] .init             PROGBITS         0000000000001000  00001000
    50.        000000000000001b  0000000000000000  AX       0     0     4
    51.   [13] .plt              PROGBITS         0000000000001020  00001020
    52.        0000000000000030  0000000000000010  AX       0     0     16
    53.   [14] .plt.got          PROGBITS         0000000000001050  00001050
    54.        0000000000000010  0000000000000010  AX       0     0     16
    55.   [15] .plt.sec          PROGBITS         0000000000001060  00001060
    56.        0000000000000020  0000000000000010  AX       0     0     16
    57.   [16] .text             PROGBITS         0000000000001080  00001080
    58.        0000000000000185  0000000000000000  AX       0     0     16
    59.   [17] .fini             PROGBITS         0000000000001208  00001208
    60.        000000000000000d  0000000000000000  AX       0     0     4
    61.   [18] .rodata           PROGBITS         0000000000002000  00002000
    62.        0000000000000013  0000000000000000   A       0     0     4
    63.   [19] .eh_frame_hdr     PROGBITS         0000000000002014  00002014
    64.        0000000000000044  0000000000000000   A       0     0     4
    65.   [20] .eh_frame         PROGBITS         0000000000002058  00002058
    66.        0000000000000108  0000000000000000   A       0     0     8
    67.   [21] .init_array       INIT_ARRAY       0000000000003db0  00002db0
    68.        0000000000000008  0000000000000008  WA       0     0     8
    69.   [22] .fini_array       FINI_ARRAY       0000000000003db8  00002db8
    70.        0000000000000008  0000000000000008  WA       0     0     8
    71.   [23] .dynamic          DYNAMIC          0000000000003dc0  00002dc0
    72.        00000000000001f0  0000000000000010  WA       7     0     8
    73.   [24] .got              PROGBITS         0000000000003fb0  00002fb0
    74.        0000000000000050  0000000000000008  WA       0     0     8
    75.   [25] .data             PROGBITS         0000000000004000  00003000
    76.        0000000000000010  0000000000000000  WA       0     0     8
    77.   [26] .bss              NOBITS           0000000000004010  00003010
    78.        0000000000000008  0000000000000000  WA       0     0     1
    79.   [27] .comment          PROGBITS         0000000000000000  00003010
    80.        000000000000002b  0000000000000001  MS       0     0     1
    81.   [28] .symtab           SYMTAB           0000000000000000  00003040
    82.        0000000000000630  0000000000000018          29    46     8
    83.   [29] .strtab           STRTAB           0000000000000000  00003670
    84.        0000000000000218  0000000000000000           0     0     1
    85.   [30] .shstrtab         STRTAB           0000000000000000  00003888
    86.        000000000000011a  0000000000000000           0     0     1
    87. Key to Flags:
    88.   W (write), A (alloc), X (execute), M (merge), S (strings), I (info),
    89.   L (link order), O (extra OS processing required), G (group), T (TLS),
    90.   C (compressed), x (unknown), o (OS specific), E (exclude),
    91.   l (large), p (processor specific)
    92.  
    93. There are no section groups in this file.
    94.  
    95. 程序头：
    96.   Type           Offset             VirtAddr           PhysAddr
    97.                  FileSiz            MemSiz              Flags  Align
    98.   PHDR           0x0000000000000040 0x0000000000000040 0x0000000000000040
    99.                  0x00000000000002d8 0x00000000000002d8  R      0x8
    100.   INTERP         0x0000000000000318 0x0000000000000318 0x0000000000000318
    101.                  0x000000000000001c 0x000000000000001c  R      0x1
    102.       [Requesting program interpreter: /lib64/ld-linux-x86-64.so.2]
    103.   LOAD           0x0000000000000000 0x0000000000000000 0x0000000000000000
    104.                  0x0000000000000638 0x0000000000000638  R      0x1000
    105.   LOAD           0x0000000000001000 0x0000000000001000 0x0000000000001000
    106.                  0x0000000000000215 0x0000000000000215  R E    0x1000
    107.   LOAD           0x0000000000002000 0x0000000000002000 0x0000000000002000
    108.                  0x0000000000000160 0x0000000000000160  R      0x1000
    109.   LOAD           0x0000000000002db0 0x0000000000003db0 0x0000000000003db0
    110.                  0x0000000000000260 0x0000000000000268  RW     0x1000
    111.   DYNAMIC        0x0000000000002dc0 0x0000000000003dc0 0x0000000000003dc0
    112.                  0x00000000000001f0 0x00000000000001f0  RW     0x8
    113.   NOTE           0x0000000000000338 0x0000000000000338 0x0000000000000338
    114.                  0x0000000000000020 0x0000000000000020  R      0x8
    115.   NOTE           0x0000000000000358 0x0000000000000358 0x0000000000000358
    116.                  0x0000000000000044 0x0000000000000044  R      0x4
    117.   GNU_PROPERTY   0x0000000000000338 0x0000000000000338 0x0000000000000338
    118.                  0x0000000000000020 0x0000000000000020  R      0x8
    119.   GNU_EH_FRAME   0x0000000000002014 0x0000000000002014 0x0000000000002014
    120.                  0x0000000000000044 0x0000000000000044  R      0x4
    121.   GNU_STACK      0x0000000000000000 0x0000000000000000 0x0000000000000000
    122.                  0x0000000000000000 0x0000000000000000  RW     0x10
    123.   GNU_RELRO      0x0000000000002db0 0x0000000000003db0 0x0000000000003db0
    124.                  0x0000000000000250 0x0000000000000250  R      0x1
    125.  
    126.  Section to Segment mapping:
    127.   段节...
    128.    00     
    129.    01     .interp 
    130.    02     .interp .note.gnu.property .note.gnu.build-id .note.ABI-tag .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt 
    131.    03     .init .plt .plt.got .plt.sec .text .fini 
    132.    04     .rodata .eh_frame_hdr .eh_frame 
    133.    05     .init_array .fini_array .dynamic .got .data .bss 
    134.    06     .dynamic 
    135.    07     .note.gnu.property 
    136.    08     .note.gnu.build-id .note.ABI-tag 
    137.    09     .note.gnu.property 
    138.    10     .eh_frame_hdr 
    139.    11     
    140.    12     .init_array .fini_array .dynamic .got 
    141.  
    142. Dynamic section at offset 0x2dc0 contains 27 entries:
    143.   标记        类型                         名称/值
    144.  0x0000000000000001 (NEEDED)             共享库：[libc.so.6]
    145.  0x000000000000000c (INIT)               0x1000
    146.  0x000000000000000d (FINI)               0x1208
    147.  0x0000000000000019 (INIT_ARRAY)         0x3db0
    148.  0x000000000000001b (INIT_ARRAYSZ)       8 (bytes)
    149.  0x000000000000001a (FINI_ARRAY)         0x3db8
    150.  0x000000000000001c (FINI_ARRAYSZ)       8 (bytes)
    151.  0x000000006ffffef5 (GNU_HASH)           0x3a0
    152.  0x0000000000000005 (STRTAB)             0x488
    153.  0x0000000000000006 (SYMTAB)             0x3c8
    154.  0x000000000000000a (STRSZ)              139 (bytes)
    155.  0x000000000000000b (SYMENT)             24 (bytes)
    156.  0x0000000000000015 (DEBUG)              0x0
    157.  0x0000000000000003 (PLTGOT)             0x3fb0
    158.  0x0000000000000002 (PLTRELSZ)           48 (bytes)
    159.  0x0000000000000014 (PLTREL)             RELA
    160.  0x0000000000000017 (JMPREL)             0x608
    161.  0x0000000000000007 (RELA)               0x548
    162.  0x0000000000000008 (RELASZ)             192 (bytes)
    163.  0x0000000000000009 (RELAENT)            24 (bytes)
    164.  0x000000000000001e (FLAGS)              BIND_NOW
    165.  0x000000006ffffffb (FLAGS_1)            标志： NOW PIE
    166.  0x000000006ffffffe (VERNEED)            0x528
    167.  0x000000006fffffff (VERNEEDNUM)         1
    168.  0x000000006ffffff0 (VERSYM)             0x514
    169.  0x000000006ffffff9 (RELACOUNT)          3
    170.  0x0000000000000000 (NULL)               0x0
    171.  
    172. 重定位节 '.rela.dyn' at offset 0x548 contains 8 entries:
    173.   偏移量          信息           类型           符号值        符号名称 + 加数
    174. 000000003db0  000000000008 R_X86_64_RELATIVE                    1160
    175. 000000003db8  000000000008 R_X86_64_RELATIVE                    1120
    176. 000000004008  000000000008 R_X86_64_RELATIVE                    4008
    177. 000000003fd8  000100000006 R_X86_64_GLOB_DAT 0000000000000000 _ITM_deregisterTMClone + 0
    178. 000000003fe0  000400000006 R_X86_64_GLOB_DAT 0000000000000000 __libc_start_main@GLIBC_2.2.5 + 0
    179. 000000003fe8  000500000006 R_X86_64_GLOB_DAT 0000000000000000 __gmon_start__ + 0
    180. 000000003ff0  000600000006 R_X86_64_GLOB_DAT 0000000000000000 _ITM_registerTMCloneTa + 0
    181. 000000003ff8  000700000006 R_X86_64_GLOB_DAT 0000000000000000 __cxa_finalize@GLIBC_2.2.5 + 0
    182.  
    183. 重定位节 '.rela.plt' at offset 0x608 contains 2 entries:
    184.   偏移量          信息           类型           符号值        符号名称 + 加数
    185. 000000003fc8  000200000007 R_X86_64_JUMP_SLO 0000000000000000 getpid@GLIBC_2.2.5 + 0
    186. 000000003fd0  000300000007 R_X86_64_JUMP_SLO 0000000000000000 printf@GLIBC_2.2.5 + 0
    187.  
    188. The decoding of unwind sections for machine type Advanced Micro Devices X86-64 is not currently supported.
    189.  
    190. Symbol table '.dynsym' contains 8 entries:
    191.    Num:    Value          Size Type    Bind   Vis      Ndx Name
    192.      0: 0000000000000000     0 NOTYPE  LOCAL  DEFAULT  UND 
    193.      1: 0000000000000000     0 NOTYPE  WEAK   DEFAULT  UND _ITM_deregisterTMCloneTab
    194.      2: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND getpid@GLIBC_2.2.5 (2)
    195.      3: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND printf@GLIBC_2.2.5 (2)
    196.      4: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND __libc_start_main@GLIBC_2.2.5 (2)
    197.      5: 0000000000000000     0 NOTYPE  WEAK   DEFAULT  UND __gmon_start__
    198.      6: 0000000000000000     0 NOTYPE  WEAK   DEFAULT  UND _ITM_registerTMCloneTable
    199.      7: 0000000000000000     0 FUNC    WEAK   DEFAULT  UND __cxa_finalize@GLIBC_2.2.5 (2)
    200.  
    201. Symbol table '.symtab' contains 66 entries:
    202.    Num:    Value          Size Type    Bind   Vis      Ndx Name
    203.      0: 0000000000000000     0 NOTYPE  LOCAL  DEFAULT  UND 
    204.      1: 0000000000000318     0 SECTION LOCAL  DEFAULT    1 
    205.      2: 0000000000000338     0 SECTION LOCAL  DEFAULT    2 
    206.      3: 0000000000000358     0 SECTION LOCAL  DEFAULT    3 
    207.      4: 000000000000037c     0 SECTION LOCAL  DEFAULT    4 
    208.      5: 00000000000003a0     0 SECTION LOCAL  DEFAULT    5 
    209.      6: 00000000000003c8     0 SECTION LOCAL  DEFAULT    6 
    210.      7: 0000000000000488     0 SECTION LOCAL  DEFAULT    7 
    211.      8: 0000000000000514     0 SECTION LOCAL  DEFAULT    8 
    212.      9: 0000000000000528     0 SECTION LOCAL  DEFAULT    9 
    213.     10: 0000000000000548     0 SECTION LOCAL  DEFAULT   10 
    214.     11: 0000000000000608     0 SECTION LOCAL  DEFAULT   11 
    215.     12: 0000000000001000     0 SECTION LOCAL  DEFAULT   12 
    216.     13: 0000000000001020     0 SECTION LOCAL  DEFAULT   13 
    217.     14: 0000000000001050     0 SECTION LOCAL  DEFAULT   14 
    218.     15: 0000000000001060     0 SECTION LOCAL  DEFAULT   15 
    219.     16: 0000000000001080     0 SECTION LOCAL  DEFAULT   16 
    220.     17: 0000000000001208     0 SECTION LOCAL  DEFAULT   17 
    221.     18: 0000000000002000     0 SECTION LOCAL  DEFAULT   18 
    222.     19: 0000000000002014     0 SECTION LOCAL  DEFAULT   19 
    223.     20: 0000000000002058     0 SECTION LOCAL  DEFAULT   20 
    224.     21: 0000000000003db0     0 SECTION LOCAL  DEFAULT   21 
    225.     22: 0000000000003db8     0 SECTION LOCAL  DEFAULT   22 
    226.     23: 0000000000003dc0     0 SECTION LOCAL  DEFAULT   23 
    227.     24: 0000000000003fb0     0 SECTION LOCAL  DEFAULT   24 
    228.     25: 0000000000004000     0 SECTION LOCAL  DEFAULT   25 
    229.     26: 0000000000004010     0 SECTION LOCAL  DEFAULT   26 
    230.     27: 0000000000000000     0 SECTION LOCAL  DEFAULT   27 
    231.     28: 0000000000000000     0 FILE    LOCAL  DEFAULT  ABS crtstuff.c
    232.     29: 00000000000010b0     0 FUNC    LOCAL  DEFAULT   16 deregister_tm_clones
    233.     30: 00000000000010e0     0 FUNC    LOCAL  DEFAULT   16 register_tm_clones
    234.     31: 0000000000001120     0 FUNC    LOCAL  DEFAULT   16 __do_global_dtors_aux
    235.     32: 0000000000004010     1 OBJECT  LOCAL  DEFAULT   26 completed.8061
    236.     33: 0000000000003db8     0 OBJECT  LOCAL  DEFAULT   22 __do_global_dtors_aux_fin
    237.     34: 0000000000001160     0 FUNC    LOCAL  DEFAULT   16 frame_dummy
    238.     35: 0000000000003db0     0 OBJECT  LOCAL  DEFAULT   21 __frame_dummy_init_array_
    239.     36: 0000000000000000     0 FILE    LOCAL  DEFAULT  ABS main.c
    240.     37: 0000000000000000     0 FILE    LOCAL  DEFAULT  ABS crtstuff.c
    241.     38: 000000000000215c     0 OBJECT  LOCAL  DEFAULT   20 __FRAME_END__
    242.     39: 0000000000000000     0 FILE    LOCAL  DEFAULT  ABS 
    243.     40: 0000000000003db8     0 NOTYPE  LOCAL  DEFAULT   21 __init_array_end
    244.     41: 0000000000003dc0     0 OBJECT  LOCAL  DEFAULT   23 _DYNAMIC
    245.     42: 0000000000003db0     0 NOTYPE  LOCAL  DEFAULT   21 __init_array_start
    246.     43: 0000000000002014     0 NOTYPE  LOCAL  DEFAULT   19 __GNU_EH_FRAME_HDR
    247.     44: 0000000000003fb0     0 OBJECT  LOCAL  DEFAULT   24 _GLOBAL_OFFSET_TABLE_
    248.     45: 0000000000001000     0 FUNC    LOCAL  DEFAULT   12 _init
    249.     46: 0000000000001200     5 FUNC    GLOBAL DEFAULT   16 __libc_csu_fini
    250.     47: 0000000000000000     0 NOTYPE  WEAK   DEFAULT  UND _ITM_deregisterTMCloneTab
    251.     48: 0000000000004000     0 NOTYPE  WEAK   DEFAULT   25 data_start
    252.     49: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND getpid@@GLIBC_2.2.5
    253.     50: 0000000000004010     0 NOTYPE  GLOBAL DEFAULT   25 _edata
    254.     51: 0000000000001208     0 FUNC    GLOBAL HIDDEN    17 _fini
    255.     52: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND printf@@GLIBC_2.2.5
    256.     53: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND __libc_start_main@@GLIBC_
    257.     54: 0000000000004000     0 NOTYPE  GLOBAL DEFAULT   25 __data_start
    258.     55: 0000000000000000     0 NOTYPE  WEAK   DEFAULT  UND __gmon_start__
    259.     56: 0000000000004008     0 OBJECT  GLOBAL HIDDEN    25 __dso_handle
    260.     57: 0000000000002000     4 OBJECT  GLOBAL DEFAULT   18 _IO_stdin_used
    261.     58: 0000000000001190   101 FUNC    GLOBAL DEFAULT   16 __libc_csu_init
    262.     59: 0000000000004018     0 NOTYPE  GLOBAL DEFAULT   26 _end
    263.     60: 0000000000001080    47 FUNC    GLOBAL DEFAULT   16 _start
    264.     61: 0000000000004010     0 NOTYPE  GLOBAL DEFAULT   26 __bss_start
    265.     62: 0000000000001169    39 FUNC    GLOBAL DEFAULT   16 main
    266.     63: 0000000000004010     0 OBJECT  GLOBAL HIDDEN    25 __TMC_END__
    267.     64: 0000000000000000     0 NOTYPE  WEAK   DEFAULT  UND _ITM_registerTMCloneTable
    268.     65: 0000000000000000     0 FUNC    WEAK   DEFAULT  UND __cxa_finalize@@GLIBC_2.2
    269.  
    270. Histogram for `.gnu.hash' bucket list length (total of 2 buckets):
    271.  Length  Number     % of total  Coverage
    272.       0  1          ( 50.0%)
    273.       1  1          ( 50.0%)    100.0%
    275. Version symbols section '.gnu.version' contains 8 entries:
    276.  地址：0x0000000000000514  Offset: 0x000514  Link: 6 (.dynsym)
    277.   000:   0 (*本地*)       0 (*本地*)       2 (GLIBC_2.2.5)   2 (GLIBC_2.2.5)
    278.   004:   2 (GLIBC_2.2.5)   0 (*本地*)       0 (*本地*)       2 (GLIBC_2.2.5)
    280. Version needs section '.gnu.version_r' contains 1 entry:
    281.  地址：0x0000000000000528  Offset: 0x000528  Link: 7 (.dynstr)
    282.   000000: Version: 1  文件：libc.so.6  计数：1
    283.   0x0010:   Name: GLIBC_2.2.5  标志：无  版本：2
    285. Displaying notes found in: .note.gnu.property
    286.   所有者            Data size 	Description
    287.   GNU                  0x00000010	NT_GNU_PROPERTY_TYPE_0
    288.       Properties: x86 feature: IBT, SHSTK
    290. Displaying notes found in: .note.gnu.build-id
    291.   所有者            Data size 	Description
    292.   GNU                  0x00000014	NT_GNU_BUILD_ID (unique build ID bitstring)
    293.     Build ID: c72301e0c49b0cd407f0056210312787d9224273
    295. Displaying notes found in: .note.ABI-tag
    296.   所有者            Data size 	Description
    297.   GNU                  0x00000010	NT_GNU_ABI_TAG (ABI version tag)
    298.     OS: Linux, ABI: 3.2.0

    重点关注节头以下信息：

    1. [13] .plt              PROGBITS         0000000000001020  00001020
    2.        0000000000000030  0000000000000010  AX       0     0     16
    3. [14] .plt.got          PROGBITS         0000000000001050  00001050
    4.        0000000000000010  0000000000000010  AX       0     0     16
    5. [15] .plt.sec          PROGBITS         0000000000001060  00001060
    6.        0000000000000020  0000000000000010  AX       0     0     16
    7. [24] .got              PROGBITS         0000000000003fb0  00002fb0
    8.        0000000000000050  0000000000000008  WA       0     0     8

    从以上表可以看出：

    其中：

    0X1020 是.plt表在程序中的偏移位置。

    0X1050 是.plt.got表在程序中的偏移位置。

    0X1060 是.plt.sec表在程序中的偏移位置。

    0X3fb0 是.got表在程序中的偏移位置。

     我们可以看到，getpid和printf函数都在这个.got表中，其中偏移量是他们在表中的地址，信息是他们实际的地址，由于程序未启动，地址还没加载，所以显示的并不是程序的实际地址。

    那么这个got表和got.plt表到底是怎么运作的呢?

    首先，当一个程序第一次调用一个外部函数时，就会跳转到.plt表（注意，不是.got.plt），而这个表中包含有一些代码，这些代码总共有两个作用：

    (1)调用链接器来解析某个外部函数的地址, 并填充到.got.plt中, 然后跳转到该函数。
    (2)在.got.plt中查找并跳转到对应外部函数(如果已经填充过)。

    相对的，.got.plt也同样具有两个功能：

     1)如果在之前查找过该符号,内容为外部函数的具体地址。

     2)如果没查找过, 则内容为跳转回.plt的代码。

    所以当你首次调用某个外部函数时，其流程为code → .plt → .got.plt → .plt→.got.plt→target function

     结合上图可更好的理解整个过程。

    接下来要hook函数就很简单了，只需要将运行中的got.plt表中对应的地址覆盖为我们自己的函数地址，当调用时，自然就调用到我们自己的函数了。

    2.2.2 got/plt hook 实现

    接下来我们来实现一下hook的过程

    首先，将测试代码改造一下，改造后测试代码如下：

    1. #include 
    2. #include 
    3. #include 
    4. int mygetpid(){
    5.     return 12306;
    6. }
    7.  
    8. int main(){
    9.  
    10.     while(true){
    11.         printf("the pid is %d\n",getpid());
    12.         sleep(1);
    13.     }
    14.     return 0;
    15. }

    改造后的代码，每隔一段时间就会打印一下pid，然后我们还新增了一个函数，用于到时候替换用，我们再用readelf -a 来查看一下编译成的执行文件的elf情况如下：

    首先是.got.plt表

    接下来是.symtab，.symtab是c程序的符号表，其中包含有各种程序的符号，其内容如下:

    我们可以看到，getpid函数和我们自己编写的mygetpid函数在这个表中都可以看到，由于getpid是外部引用函数，其地址是使用时动态加载，所以此时为0，接下来的内容就很明确了，我们只需要把.got.plt表中，位置为0X3fc0的值，覆写成我们自己的mygetpid函数的地址，就可以hook住getpid函数了。

    那么我们应该怎么才能修改程序运行时候的内存地址呢，我们都知道，linux秉承的是万物皆文件的原则，程序在运行时候，其内存会映射为一个/proc/$pid/mem文件，修改这个文件，等于修改程序内存（其实这样说不够严谨，差不多是这个意思）。

    于是我们可以编写个程序用来修改程序运行时候的内存，代码如下:

    1. vim inject.c
    2. --------------------------------------------
    3. #include 
    4. #include 
    5. #include 
    6. int main(int argc,char* argv[]) {
    7.     int pid = atoi(argv[1]);
    8.     unsigned long offset = 0x601018;
    9.     unsigned long myfunctionaddr = 0x4005b6;
    10.     char filename[32];
    11.     snprintf(filename, sizeof(filename),"/proc/%d/mem",pid);
    12.     int fd = open(filename, O_RDWR|O_SYNC);
    13.     lseek(fd,offset,SEEK_SET);
    14.     write(fd,&myfunctionaddr, sizeof(unsigned long));
    15.     return 0;
    16. }
    17. -----------------------------------
    18. gcc -o inect inject.c

  • 相关阅读:
    JS类的继承和实现原理详解
    Linux操作系统——硬盘的挂载和卸载
    java下标索引异常
    OpenHarmony如何拨打电话
    8.菜品展示、购物车、下单开发
    CSP-J2 2022 游记
    A_03.Aosp11源码开发环境搭建
    C++程序性能控制（cpu，内存，带宽，io）
    antv G6 开发踩坑记录
    US-DAPQ-N驱动双比例阀的比例放大器
  • 原文地址：https://blog.csdn.net/weixin_42136255/article/details/126249768