search

Artemis21 / ptrace-inject

Shared library injection for *nix using ptrace, in Rust.
11 stars 1 forks source link

search libc.so.6 in /proc/<pid>/maps failed #1

Open HerlinCoder opened 8 months ago

HerlinCoder commented 8 months ago

hi, I am trying to use this crate to inject a share library into process. But it failed with this error:

thread 'main' panicked at 'called `Result::unwrap()` on an `Err` value: failed to inject shellcode
Caused by:
   0: couldn't get libc function addresses for tracee
   1: getting the local libc offset failed
   2: could not find libc in the target process

This means searching libc.so.6 failed. Here is what i found on my machine:

$ls /usr/lib64/ -l | grep libc.so.6
lrwxrwxrwx  1 root root       12 Dec 19  2019 libc.so.6 -> libc-2.30.so

And when the process is running, what we can find in /proc//maps is "libc-2.30.so" rather than "libc.so.6":

7f29dbd55000-7f29dbd7a000 r--p 00000000 08:03 661688                     /usr/lib64/libc-2.30.so
7f29dbd7a000-7f29dbec7000 r-xp 00025000 08:03 661688                     /usr/lib64/libc-2.30.so
7f29dbec7000-7f29dbf11000 r--p 00172000 08:03 661688                     /usr/lib64/libc-2.30.so
7f29dbf11000-7f29dbf12000 ---p 001bc000 08:03 661688                     /usr/lib64/libc-2.30.so
7f29dbf12000-7f29dbf15000 r--p 001bc000 08:03 661688                     /usr/lib64/libc-2.30.so
7f29dbf15000-7f29dbf18000 rw-p 001bf000 08:03 661688                     /usr/lib64/libc-2.30.so

Maybe we can have a check if it is a symbolic link and get the correct file name? Thanks.

Artemis21 commented 7 months ago

Thanks for posting, and apologies for the delayed reply.

Basically all that should really matter is that the libc we find:

  1. Be the same library as the one ptrace-inject is linked to (because we use addresses in the local process to determine addresses in the remote process).
  2. Have compatible implementations of malloc, dlopen and free.

Your solution sounds like a good one, and while I don't have the time to implement and test it at the moment I would be happy to review and merge if you wanted to submit a PR.