lkml.org 
[lkml]   [2011]   [Aug]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [EXAMPLE CODE] Parasite thread injection and TCP connection hijacking
    On 08/06/2011 08:12 AM, Tejun Heo wrote:
    > Hello, guys.
    >
    > So, here's transparent TCP connection hijacking (ie. checkpointing in
    > one process and restoring in another) which adds only relatively small
    > pieces to the kernel. It's by no means complete but already works
    > rather reliably in my test setup even with heavy delay induced with
    > tc.
    >
    > I wrote a rather long README describing how it's working, what's
    > missing which is appended at the end of this mail so if you're
    > interested in the details please go ahead and read.

    That's a little gross but quite cool.

    I think you have an annoying corner case, though:

    > 2. Decide where to inject the foreign code and save the original code
    > with PTRACE_PEEKDATA. Tracer can poke any mapped area regardless
    > of protection flags but it can't add execution permission to the
    > code, so it needs to choose memory area which already has X flag
    > set. The example code uses the page the %rip is in.

    If the process is executing from the vsyscall page, then you'll probably
    fail. (Admittedly, this is rather unlikely, given that the vsyscalls
    are now exactly one instruction.) Presumably you also fail if executing
    from a read-only MAP_SHARED mapping.

    Windows has a facility to more-or-less call mmap on behalf of another
    process, and another one to directly inject a thread into a remote
    process. It's traditional to use them for this type of manipulation.
    Perhaps Linux should get the same thing. (Although you could accomplish
    much the same thing if you could create a task with your mm but the
    tracee's fs.)

    --Andy


    \
     
     \ /
      Last update: 2011-08-06 14:49    [W:0.024 / U:61.296 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site