Playing with ptrace, Part II

In Part II of his series on ptrace, Pradeep tackles the more advanced topics of setting breakpoints and injecting code into running processes.

In Part I of this article[LJ, November 2002], we saw how ptrace can beused to trace system calls and change system call arguments. Inthis article, we investigate advanced techniques like settingbreakpoints and injecting code into running programs. Debuggers usethese methods to set up breakpoints and execute debugging handlers.As with Part I, all code in this article is i386architecture-specific.

Attaching to a Running Process

In Part I, we ran the process to be traced as a child aftercalling ptrace(PTRACE_TRACEME, ..). If you simply wanted to see howthe process is making system calls and trace the program, thiswould be sufficient. If you want to trace or debug a processalready running, then ptrace(PTRACE_ATTACH, ..) should beused.

When a ptrace(PTRACE_ATTACH, ..) is called with the pid to betraced, it is roughly equivalent to the process callingptrace(PTRACE_TRACEME, ..) and becoming a child of the tracingprocess. The traced process is sent a SIGSTOP, so we can examineand modify the process as usual. After we are done withmodifications or tracing, we can let the traced process continue onits own by calling ptrace(PTRACE_DETACH, ..).

The following is the code for a small example tracingprogram:

[cpp]  view plain copy

1. int main()  
2. {   int i;  
3.     for(i = 0;i < 10; ++i) {  
4.         printf("My counter: %d\n", i);  
5.         sleep(2);  
6.     }  
7.     return 0;  
8. }  

Save the program as dummy2.c. Compile and run it:

[cpp]  view plain copy

1. gcc -o dummy2 dummy2.c  
2. ./dummy2 &  

Now, we can attach to dummy2 by using the code below:

[cpp]  view plain copy

1. #include <sys/ptrace.h>  
2. #include <sys/types.h>  
3. #include <sys/wait.h>  
4. #include <unistd.h>  
5. #include <linux/user.h>   /* For user_regs_struct  
6.                              etc. */  
7. int main(int argc, char *argv[])  
8. {   pid_t traced_process;  
9.     struct user_regs_struct regs;  
10.     long ins;  
11.     if(argc != 2) {  
12.         printf("Usage: %s <pid to be traced>\n",  
13.                argv[0], argv[1]);  
14.         exit(1);  
15.     }  
16.     traced_process = atoi(argv[1]);  
17.     ptrace(PTRACE_ATTACH, traced_process,  
18.            NULL, NULL);  
19.     wait(NULL);  
20.     ptrace(PTRACE_GETREGS, traced_process,  
21.            NULL, ®s);  
22.     ins = ptrace(PTRACE_PEEKTEXT, traced_process,  
23.                  regs.eip, NULL);  
24.     printf("EIP: %lx Instruction executed: %lx\n",  
25.            regs.eip, ins);  
26.     ptrace(PTRACE_DETACH, traced_process,  
27.            NULL, NULL);  
28.     return 0;  
29. }  

The above program simply attaches to a process, waits for it tostop, examines its eip (instruction pointer) and detaches.

To inject code use ptrace(PTRACE_POKETEXT, ..) andptrace(PTRACE_POKEDATA, ..) after the traced process hasstopped.

Setting Breakpoints

How do debuggers set breakpoints? Generally, they replace theinstruction to be executed with a trap instruction, so that whenthe traced program stops, the tracing program, the debugger, canexamine it. It will replace the original instruction once thetracing program continues the traced process. Here's anexample:

[cpp]  view plain copy

1. #include <sys/ptrace.h>  
2. #include <sys/types.h>  
3. #include <sys/wait.h>  
4. #include <unistd.h>  
5. #include <linux/user.h>  
6. const int long_size = sizeof(long);  
7. void getdata(pid_t child, long addr,  
8.              char *str, int len)  
9. {   char *laddr;  
10.     int i, j;  
11.     union u {  
12.             long val;  
13.             char chars[long_size];  
14.     }data;  
15.     i = 0;  
16.     j = len / long_size;  
17.     laddr = str;  
18.     while(i < j) {  
19.         data.val = ptrace(PTRACE_PEEKDATA, child,  
20.                           addr + i * 4, NULL);  
21.         memcpy(laddr, data.chars, long_size);  
22.         ++i;  
23.         laddr += long_size;  
24.     }  
25.     j = len % long_size;  
26.     if(j != 0) {  
27.         data.val = ptrace(PTRACE_PEEKDATA, child,  
28.                           addr + i * 4, NULL);  
29.         memcpy(laddr, data.chars, j);  
30.     }  
31.     str[len] = '\0';  
32. }  
33. void putdata(pid_t child, long addr,  
34.              char *str, int len)  
35. {   char *laddr;  
36.     int i, j;  
37.     union u {  
38.             long val;  
39.             char chars[long_size];  
40.     }data;  
41.     i = 0;  
42.     j = len / long_size;  
43.     laddr = str;  
44.     while(i < j) {  
45.         memcpy(data.chars, laddr, long_size);  
46.         ptrace(PTRACE_POKEDATA, child,  
47.                addr + i * 4, data.val);  
48.         ++i;  
49.         laddr += long_size;  
50.     }  
51.     j = len % long_size;  
52.     if(j != 0) {  
53.         memcpy(data.chars, laddr, j);  
54.         ptrace(PTRACE_POKEDATA, child,  
55.                addr + i * 4, data.val);  
56.     }  
57. }  
58. int main(int argc, char *argv[])  
59. {   pid_t traced_process;  
60.     struct user_regs_struct regs, newregs;  
61.     long ins;  
62.     /* int 0x80, int3 */  
63.     char code[] = {0xcd,0x80,0xcc,0};  
64.     char backup[4];  
65.     if(argc != 2) {  
66.         printf("Usage: %s <pid to be traced>\n",  
67.                argv[0], argv[1]);  
68.         exit(1);  
69.     }  
70.     traced_process = atoi(argv[1]);  
71.     ptrace(PTRACE_ATTACH, traced_process,  
72.            NULL, NULL);  
73.     wait(NULL);  
74.     ptrace(PTRACE_GETREGS, traced_process,  
75.            NULL, ®s);  
76.     /* Copy instructions into a backup variable */  
77.     getdata(traced_process, regs.eip, backup, 3);  
78.     /* Put the breakpoint */  
79.     putdata(traced_process, regs.eip, code, 3);  
80.     /* Let the process continue and execute 
81.        the int 3 instruction */  
82.     ptrace(PTRACE_CONT, traced_process, NULL, NULL);  
83.     wait(NULL);  
84.     printf("The process stopped, putting back "  
85.            "the original instructions\n");  
86.     printf("Press <enter> to continue\n");  
87.     getchar();  
88.     putdata(traced_process, regs.eip, backup, 3);  
89.     /* Setting the eip back to the original 
90.        instruction to let the process continue */  
91.     ptrace(PTRACE_SETREGS, traced_process,  
92.            NULL, ®s);  
93.     ptrace(PTRACE_DETACH, traced_process,  
94.            NULL, NULL);  
95.     return 0;  
96. }  

Here we replace the three bytes with the code for a trapinstruction, and when the process stops, we replace the originalinstructions and reset the eip to original location. Figures 1-4clarify how the instruction stream looks when above program isexecuted.

                                   

               Figure 1. After the Process Is Stopped                                                Figure 2. After the Trap Instruction Bytes AreSet

                                       

Figure 3. Trap Is Hit and Control Is Given to theTracing Program              Figure 4. After the Original Instructions Are Replacedand eip Is Reset to the Original Location

Now that we have a clear idea of how breakpoints are set,let's inject some code bytes into a running program. These codebytes will print “hello world”.

The following program is a simple “hello world” programwith modifications to fit our needs. Compile the following programwith:

[cpp]  view plain copy

1. gcc -o hello hello.c  
2. void main()  
3. {  
4. __asm__("  
5.          jmp forward  
6. backward:  
7.          popl   %esi      # Get the address of  
8.                           # hello world string  
9.          movl   $4, %eax  # Do write system call  
10.          movl   $2, %ebx  
11.          movl   %esi, %ecx  
12.          movl   $12, %edx  
13.          int    $0x80  
14.          int3             # Breakpoint. Here the  
15.                           # program will stop and  
16.                           # give control back to  
17.                           # the parent  
18. forward:  
19.          call   backward  
20.          .string \"Hello World\\n\""  
21.        );  
22. }  

The jumping backward and forward here is required to find theaddress of the “hello world” string.

We can get the machine code for the above assembly from GDB.Fire up GDB and disassemble the program:

[cpp]  view plain copy

1. (gdb) disassemble main  
2. Dump of assembler code for function main:  
3. 0x80483e0 <main>:       push   %ebp  
4. 0x80483e1 <main+1>:     mov    %esp,%ebp  
5. 0x80483e3 <main+3>:     jmp    0x80483fa <forward>  
6. End of assembler dump.  
7. (gdb) disassemble forward  
8. Dump of assembler code for function forward:  
9. 0x80483fa <forward>:    call   0x80483e5 <backward>  
10. 0x80483ff <forward+5>:  dec    %eax  
11. 0x8048400 <forward+6>:  gs  
12. 0x8048401 <forward+7>:  insb   (%dx),%es:(%edi)  
13. 0x8048402 <forward+8>:  insb   (%dx),%es:(%edi)  
14. 0x8048403 <forward+9>:  outsl  %ds:(%esi),(%dx)  
15. 0x8048404 <forward+10>: and    %dl,0x6f(%edi)  
16. 0x8048407 <forward+13>: jb     0x8048475  
17. 0x8048409 <forward+15>: or     %fs:(%eax),%al  
18. 0x804840c <forward+18>: mov    %ebp,%esp  
19. 0x804840e <forward+20>: pop    %ebp  
20. 0x804840f <forward+21>: ret  
21. End of assembler dump.  
22. (gdb) disassemble backward  
23. Dump of assembler code for function backward:  
24. 0x80483e5 <backward>:   pop    %esi  
25. 0x80483e6 <backward+1>: mov    $0x4,%eax  
26. 0x80483eb <backward+6>: mov    $0x2,%ebx  
27. 0x80483f0 <backward+11>:        mov    %esi,%ecx  
28. 0x80483f2 <backward+13>:        mov    $0xc,%edx  
29. 0x80483f7 <backward+18>:        int    $0x80  
30. 0x80483f9 <backward+20>:        int3  
31. End of assembler dump.  

We need to take the machine code bytes from main+3 tobackward+20, which is a total of 41 bytes. The machine code can beseen with the x command in GDB:

[cpp]  view plain copy

1. (gdb) x/40bx main+3  
2. <main+3>: eb 15 5e b8 04 00 00 00  
3. <backward+6>: bb 02 00 00 00 89 f1 ba  
4. <backward+14>: 0c 00 00 00 cd 80 cc  
5. <forward+1>: e6 ff ff ff 48 65 6c 6c  
6. <forward+9>: 6f 20 57 6f 72 6c 64 0a  

Now we have the instruction bytes to be executed. Why wait? We caninject them using the same method as in the previous example. Thefollowing is the source code; only the main function is given here:

[cpp]  view plain copy

1. int main(int argc, char *argv[])  
2. {   pid_t traced_process;  
3.     struct user_regs_struct regs, newregs;  
4.     long ins;  
5.     int len = 41;  
6.     char insertcode[] =  
7. "\xeb\x15\x5e\xb8\x04\x00"  
8.         "\x00\x00\xbb\x02\x00\x00\x00\x89\xf1\xba"  
9.         "\x0c\x00\x00\x00\xcd\x80\xcc\xe8\xe6\xff"  
10.         "\xff\xff\x48\x65\x6c\x6c\x6f\x20\x57\x6f"  
11.         "\x72\x6c\x64\x0a\x00";  
12.     char backup[len];  
13.     if(argc != 2) {  
14.         printf("Usage: %s <pid to be traced>\n",  
15.                argv[0], argv[1]);  
16.         exit(1);  
17.     }  
18.     traced_process = atoi(argv[1]);  
19.     ptrace(PTRACE_ATTACH, traced_process,  
20.            NULL, NULL);  
21.     wait(NULL);  
22.     ptrace(PTRACE_GETREGS, traced_process,  
23.            NULL, ®s);  
24.     getdata(traced_process, regs.eip, backup, len);  
25.     putdata(traced_process, regs.eip,  
26.             insertcode, len);  
27.     ptrace(PTRACE_SETREGS, traced_process,  
28.            NULL, ®s);  
29.     ptrace(PTRACE_CONT, traced_process,  
30.            NULL, NULL);  
31.     wait(NULL);  
32.     printf("The process stopped, Putting back "  
33.            "the original instructions\n");  
34.     putdata(traced_process, regs.eip, backup, len);  
35.     ptrace(PTRACE_SETREGS, traced_process,  
36.            NULL, ®s);  
37.     printf("Letting it continue with "  
38.            "original flow\n");  
39.     ptrace(PTRACE_DETACH, traced_process,  
40.            NULL, NULL);  
41.     return 0;  
42. }  

Injecting the Code into Free Space

In the previous example we injected the code directly intothe executing instruction stream. However, debuggers can getconfused with this kind of behaviour, so let's find the free spacein the process and inject the code there. We can find free space byexamining the /proc/pid/maps file of the traced process. Thefollowing function will find the starting address of thismap:

[cpp]  view plain copy

1. long freespaceaddr(pid_t pid)  
2. {  
3.     FILE *fp;  
4.     char filename[30];  
5.     char line[85];  
6.     long addr;  
7.     char str[20];  
8.     sprintf(filename, "/proc/%d/maps", pid);  
9.     fp = fopen(filename, "r");  
10.     if(fp == NULL)  
11.         exit(1);  
12.     while(fgets(line, 85, fp) != NULL) {  
13.         sscanf(line, "%lx-%*lx %*s %*s %s", &addr,  
14.                str, str, str, str);  
15.         if(strcmp(str, "00:00") == 0)  
16.             break;  
17.     }  
18.     fclose(fp);  
19.     return addr;  
20. }  

Each line in /proc/pid/maps represents a mapped region of theprocess. An entry in /proc/pid/maps looks like this:

[cpp]  view plain copy

1. map start-mapend    protection  offset     device  
2. inode      process file  
3. 08048000-0804d000   r-xp        00000000   03:08  
4. 66111      /opt/kde2/bin/kdeinit  

The following program injects code into free space. It's similar tothe previous injection program except the free space address isused for keeping our new code. Here is the source code for the mainfunction:

[cpp]  view plain copy

1. int main(int argc, char *argv[])  
2. {   pid_t traced_process;  
3.     struct user_regs_struct oldregs, regs;  
4.     long ins;  
5.     int len = 41;  
6.     char insertcode[] =  
7. "\xeb\x15\x5e\xb8\x04\x00"  
8.         "\x00\x00\xbb\x02\x00\x00\x00\x89\xf1\xba"  
9.         "\x0c\x00\x00\x00\xcd\x80\xcc\xe8\xe6\xff"  
10.         "\xff\xff\x48\x65\x6c\x6c\x6f\x20\x57\x6f"  
11.         "\x72\x6c\x64\x0a\x00";  
12.     char backup[len];  
13.     long addr;  
14.     if(argc != 2) {  
15.         printf("Usage: %s <pid to be traced>\n",  
16.                argv[0], argv[1]);  
17.         exit(1);  
18.     }  
19.     traced_process = atoi(argv[1]);  
20.     ptrace(PTRACE_ATTACH, traced_process,  
21.            NULL, NULL);  
22.     wait(NULL);  
23.     ptrace(PTRACE_GETREGS, traced_process,  
24.            NULL, ®s);  
25.     addr = freespaceaddr(traced_process);  
26.     getdata(traced_process, addr, backup, len);  
27.     putdata(traced_process, addr, insertcode, len);  
28.     memcpy(&oldregs, ®s, sizeof(regs));  
29.     regs.eip = addr;  
30.     ptrace(PTRACE_SETREGS, traced_process,  
31.            NULL, ®s);  
32.     ptrace(PTRACE_CONT, traced_process,  
33.            NULL, NULL);  
34.     wait(NULL);  
35.     printf("The process stopped, Putting back "  
36.            "the original instructions\n");  
37.     putdata(traced_process, addr, backup, len);  
38.     ptrace(PTRACE_SETREGS, traced_process,  
39.            NULL, &oldregs);  
40.     printf("Letting it continue with "  
41.            "original flow\n");  
42.     ptrace(PTRACE_DETACH, traced_process,  
43.            NULL, NULL);  
44.     return 0;  
45. }  

Behind the Scenes

So what happens within the kernel now? How is ptraceimplemented? This section could be an article on its own; however,here's a brief description of what happens.

When a process calls ptrace with PTRACE_TRACEME, the kernelsets up the process flags to reflect that it is beingtraced:

[cpp]  view plain copy

1. Source: arch/i386/kernel/ptrace.c  
2. if (request == PTRACE_TRACEME) {  
3.     /* are we already being traced? */  
4.     if (current->ptrace & PT_PTRACED)  
5.         goto out;  
6.     /* set the ptrace bit in the process flags. */  
7.     current->ptrace |= PT_PTRACED;  
8.     ret = 0;  
9.     goto out;  
10. }  

When a system call entry is done, the kernel checks this flagand calls the trace system call if the process is being traced. Thegory assembly details can be found in arch/i386/kernel/entry.S.

Now, we are in the sys_trace() function as defined inarch/i386/kernel/ptrace.c. It stops the child and sends a signal tothe parent notifying that the child is stopped. This wakes up thewaiting parent, and it does the ptrace magic. Once the parent isdone, and it calls ptrace(PTRACE_CONT, ..) orptrace(PTRACE_SYSCALL, ..), it wakes up the child by calling thescheduler function wake_up_process(). Some other architectures canimplement this by sending a SIGCHLD to child.

Conclusion

ptrace may appear to bemagic to some people, because it can examine and modify a runningprogram. It is generally used by debuggers and system call tracingprograms, such as ptrace. It opens up interesting possibilities fordoing user-mode extensions as well. There have been a lot ofattempts to extend the operating system on the user level. SeeResources to read about UFO, a user-level extension to filesystems.ptrace also is used to employsecurity mechanisms.

All example code from this article and from Part I isavailable as a tar archive on the Linux Journal FTP site[ftp.linuxjournal.com/pub/lj/listings/issue104/6210.tgz].