Class: MemoryIO::Process

Inherits:
Object
  • Object
show all
Defined in:
lib/memory_io/process.rb

Overview

Records information of a process.

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(pid, endian: nil, pointer_size: nil) ⇒ Process

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Note:

This class only supports procfs-based system. i.e. /proc is mounted and readable.

Create process object from pid.

Parameters:

  • pid (Integer) —

    Process id.

  • endian (:little, :big, :native, nil) (defaults to: nil) —

    Byte order of the process's memory.

  • pointer_size (Integer?) (defaults to: nil) —

    Size of a pointer in the process, in bytes.

    Both default to what the process's executable declares, so a 32-bit process is read correctly without being told. Pass them to override a target whose executable can't be examined, or names an interpreter rather than the program itself.

Raises:



40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
 
# File 'lib/memory_io/process.rb', line 40

def initialize(pid, endian: nil, pointer_size: nil)
  @pid = pid
  @mem = "/proc/#{pid}/mem"
  # check permission of '/proc/pid/mem'
  @perm = MemoryIO::Util.file_permission(@mem)
  raise MemoryIO::ProcessNotFoundError, "#{@mem} does not exist" if perm.nil?

  @context = build_context(endian, pointer_size)

  MemoryIO.logger.warn(<<-EOS.strip) unless perm.readable? || perm.writable?
You have no permission to read/write this process.

Check the setting of /proc/sys/kernel/yama/ptrace_scope, or try
again as the root user.

To enable attach another process, do:

$ echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope
  EOS
end

Instance Attribute Details

#context ⇒ MemoryIO::Context (readonly)

Returns The context of this process's memory.

Returns:



17
18
19
 
# File 'lib/memory_io/process.rb', line 17

def context
  @context
end

#perm ⇒ #readable?, #writable? (readonly)

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Returns:

  • (#readable?, #writable?) 


13
14
15
 
# File 'lib/memory_io/process.rb', line 13

def perm
  @perm
end

Instance Method Details

#bases ⇒ {Symbol => Integer}

Parse /proc/[pid]/maps to get all bases.

Examples:

process = Process.new(`pidof victim`.to_i)
puts process.bases.map { |key, val| format('%s: 0x%016x', key, val) }
# vsyscall: 0xffffffffff600000
# vdso: 0x00007ffd5b565000
# vvar: 0x00007ffd5b563000
# stack: 0x00007ffd5ad21000
# ld: 0x00007f339a69b000
# libc: 0x00007f33996f1000
# heap: 0x00005571994a1000
# victim: 0x0000557198bcb000
#=> nil

Returns:

  • ({Symbol => Integer}) —

    Hash of bases.



78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
 
# File 'lib/memory_io/process.rb', line 78

def bases
  file = "/proc/#{@pid}/maps"
  stat = MemoryIO::Util.file_permission(file)
  return {} unless stat&.readable?

  maps = ::IO.binread(file).split("\n").map do |line|
    # 7f76515cf000-7f76515da000 r-xp 00000000 fd:01 29360257  /lib/x86_64-linux-gnu/libnss_files-2.24.so
    addr, _perm, _offset, _dev, _inode, pathname = line.strip.split(' ', 6)
    next nil if pathname.nil?

    addr = addr.to_i(16)
    pathname = pathname[1..-2] if pathname =~ /^\[.+\]$/
    pathname = ::File.basename(pathname)
    [MemoryIO::Util.trim_libname(pathname).to_sym, addr]
  end
  maps.compact.reverse.to_h
end

#read(addr, num_elements, **options) ⇒ String, ...

Read from process's memory.

This method has almost same arguments and return types as IO#read. The only difference is this method needs parameter addr (which will be passed to parameter from in IO#read).

Examples:

process = MemoryIO.attach(`pidof victim`.to_i)
puts process.read('heap', 4, as: :u64).map { |c| '0x%016x' % c }
# 0x0000000000000000
# 0x0000000000000021
# 0x00000000deadbeef
# 0x0000000000000000
#=> nil
process.read('heap+0x10', 4, as: :u8).map { |c| '0x%x' % c }
#=> ['0xef', '0xbe', '0xad', '0xde']

process.read('libc', 4)
#=> "\x7fELF"

Parameters:

  • addr (Integer, String) —

    The address start to read. When String is given, it will be safe-evaluated. You can use variables such as 'heap'/'stack'/'libc' in this parameter. See examples.

  • num_elements (Integer) —

    Number of elements to read. See IO#read.

Returns:

  • (String, Object, Array<Object>) —

    See IO#read.

Raises:

See Also:



130
131
132
 
# File 'lib/memory_io/process.rb', line 130

def read(addr, num_elements, **options)
  mem_io(:read) { |io| io.read(num_elements, from: resolve_address(addr), **options) }
end

#write(addr, objects, **options) ⇒ void

This method returns an undefined value.

Write objects at addr.

This method has almost same arguments as IO#write.

Examples:

process = MemoryIO.attach('self')
s = 'A' * 16
process.write(s.object_id * 2 + 16, 'BBBBCCCC')
s
#=> 'BBBBCCCCAAAAAAAA'

Parameters:

  • addr (Integer, String) —

    The address to start to write. See examples.

  • objects (Object, Array<Object>) —

    Objects to write. If objects is an array, the write procedure will be invoked objects.size times.

Raises:

See Also:



157
158
159
 
# File 'lib/memory_io/process.rb', line 157

def write(addr, objects, **options)
  mem_io(:write) { |io| io.write(objects, from: resolve_address(addr), **options) }
end