Advertisement
Guest User

meh

a guest
May 8th, 2017
129
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C++ 3.81 KB | None | 0 0
  1. #include <iostream>
  2. #include <cstdio>
  3. #include <cstdlib>
  4. #include <chrono>
  5. #include <thread>
  6.  
  7. #include <sys/types.h>
  8. #include <sys/ptrace.h>
  9. #include <unistd.h>
  10. #include <sys/user.h>
  11.  
  12. #ifdef __x86_64__
  13. typedef struct
  14. {
  15.     unsigned long r15;
  16.     unsigned long r14;
  17.     unsigned long r13;
  18.     unsigned long r12;
  19.     unsigned long rbp;
  20.     unsigned long rbx;
  21.     unsigned long r11;
  22.     unsigned long r10;
  23.     unsigned long r9;
  24.     unsigned long r8;
  25.     unsigned long rax;
  26.     unsigned long rcx;
  27.     unsigned long rdx;
  28.     unsigned long rsi;
  29.     unsigned long rdi;
  30.     unsigned long orig_rax;
  31.     unsigned long rip;
  32.     unsigned long cs;
  33.     unsigned long eflags;
  34.     unsigned long rsp;
  35.     unsigned long ss;
  36.     unsigned long fs_base;
  37.     unsigned long gs_base;
  38.     unsigned long ds;
  39.     unsigned long es;
  40.     unsigned long fs;
  41.     unsigned long gs;
  42. } user_regs_struct;
  43. #elif defined __i386__
  44. typedef struct
  45. {
  46.     unsigned long   ebx;
  47.     unsigned long   ecx;
  48.     unsigned long   edx;
  49.     unsigned long   esi;
  50.     unsigned long   edi;
  51.     unsigned long   ebp;
  52.     unsigned long   eax;
  53.     unsigned long   ds;
  54.     unsigned long   es;
  55.     unsigned long   fs;
  56.     unsigned long   gs;
  57.     unsigned long   orig_eax;
  58.     unsigned long   eip;
  59.     unsigned long   cs;
  60.     unsigned long   eflags;
  61.     unsigned long   esp;
  62.     unsigned long   ss;
  63. } user_regs_struct;
  64. #elif defined(__arm__)
  65.  
  66. #endif
  67.  
  68. void SetRegisters(pid_t pid)
  69. {
  70.     user_regs_struct regs;
  71.     long result = ptrace(PTRACE_GETREGS, pid, NULL, &regs);
  72.     if (result == 0)
  73.     {
  74.         #ifdef __x86_64__
  75.         std::cout<<"Read Register: "<<std::hex<<regs.rax<<"\n";
  76.         regs.rax = 0xDEADBEEF;
  77.         #elif defined __i386__
  78.         std::cout<<"Read Register: "<<std::hex<<regs.eax<<"\n";
  79.         regs.eax = 0xDEADBEEF;
  80.         #endif
  81.         result = ptrace(PTRACE_SETREGS, pid, NULL, &regs);
  82.        
  83.         if (result == 0)
  84.         {
  85.             std::cout<<"Failed To Set Registers\n";
  86.         }
  87.     }
  88.     else
  89.     {
  90.         std::cout<<"Failed To Read Registers\n";
  91.     }
  92. }
  93.  
  94. void GetRegisters(pid_t pid)
  95. {
  96.     struct user_regs_struct regs;
  97.     long result = ptrace(PTRACE_GETREGS, pid, NULL, &regs);
  98.    
  99.     if (result == 0)
  100.     {
  101.         #ifdef __x86_64__
  102.         std::cout<<"Read Registers: "<<regs.rax<<"\n";
  103.         #elif defined __i386__
  104.         std::cout<<"Read Registers: "<<regs.eax<<"\n";
  105.         #endif
  106.     }
  107. }
  108.  
  109. template<typename T>
  110. void ReadPages(pid_t pid, void* offset, T* value)
  111. {
  112.     char buffer[256] = {0};
  113.     sprintf(buffer, "/proc/%d/mem", pid);
  114.     FILE* fd = fopen(buffer, "r");
  115.     wait(pid, nullptr, 0);
  116.     fseek(fd, reinterpret_cast<std::ptrdiff_t>(offset), SEEK_SET);
  117.     fread(value, 1, sizeof(T), fd);
  118.     fclose(fd);
  119. }
  120.  
  121. int main(int argc, const char * argv[]) {
  122.  
  123.     if (argc > 2) {
  124.         std::boolalpha(std::cout);
  125.         std::int32_t pid = std::atoi(argv[1]);
  126.         std::ptrdiff_t addr = std::atoll(argv[2]);
  127.         std::cout<<"ATTACHING TO PROCESS: "<<pid<<"\n";
  128.        
  129.         std::int32_t result = ptrace(PT_ATTACH, pid, nullptr, 0);
  130.         std::cout<<"ATTACHED: "<<static_cast<bool>(result == 0)<<"\n";
  131.        
  132.         std::this_thread::sleep_for(std::chrono::seconds(1));
  133.  
  134.         GetRegisters(pid);
  135.         SetRegisters(pid);
  136.  
  137.         int val = 0;
  138.         ReadPages<int>(pid, addr, &val);
  139.         std::cout<<"Read Integer: "<<val<<" at Address: "<<std::hex<<reinterpret_cast<void*>(addr)<<"\n";
  140.  
  141.        
  142.         result = ptrace (PT_CONTINUE, pid, nullptr, 0);
  143.         std::cout<<"CONTINUED: "<<static_cast<bool>(result == 0)<<"\n";
  144.  
  145.         result = ptrace (PT_DETACH, pid, nullptr, 0);
  146.         std::cout<<"DETACHED: "<<static_cast<bool>(result == 0)<<"\n";
  147.     }
  148.     else {
  149.         std::cout<<"Terminating.. PID or Addr Argument Missing..\n";
  150.     }
  151.    
  152.     return 0;
  153. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement