search

gaffe23 / linux-inject

Tool for injecting a shared object into a Linux process
Other
1.1k stars 246 forks source link

fix target crash issue caused by movaps alignment requirement #17

Open CubicStone31 opened 2 years ago

CubicStone31 commented 2 years ago

On some machines of linux x86_64, dlopen() may use movaps instruction, and this requires the target memory (often the stack) to be properly aligned. If not, it will crash the program.

For example, on my machine, the injection failed with this error:

instead of expected SIGTRAP, target stopped with signal 11: Segmentation fault
sending process 9862 a SIGSTOP signal for debugging purposes

Then after I attached gdb to the injected process. I found it stopped at movaps instruction

   0x7f4d7be675cc:      mov    %r12,0x30(%rsp)
   0x7f4d7be675d1:      movhps 0xb0(%rsp),%xmm0
   0x7f4d7be675d9:      mov    %ebp,0x38(%rsp)
=> 0x7f4d7be675dd:      movaps %xmm0,0x60(%rsp)
   0x7f4d7be675e2:      movq   $0x0,0x48(%rsp)
   0x7f4d7be675eb:      mov    %rbx,0x50(%rsp)

and current RSP is 0x7ffe3049fb78. It is not aligned as required.

You can find movaps's alignment issue in detail here: https://www.felixcloutier.com/x86/movaps

Adding a and $0xfffffffffffff000, %rsp \n to the beginning of the shellcode should fix this.