  1#include 
  2#include 
  3#include 
  4#include 
  5#include 
  6#include 
  7#include 
  8#include 
  9
 10#define MAX_WATCH 65536
 11
 12struct game {
 13  const char *name;  // Name of the binary
 14  int pid;           // Process ID
 15
 16  int memfd;         // Address space of the process
 17  int bits;          // Search bit-width (16, 32, or 64)
 18  bool has_watch;    // Watched values
 19  uintptr_t watch[MAX_WATCH];
 20};
 21
 22FILE* popens(const char* fmt, ...);
 23uint64_t mem_load(char *mem, int off, int bits);
 24
 25void scan(struct game *g, uint32_t val) {
 26  uintptr_t start, kb;
 27  char perm[16];
 28  FILE *fp = popens("pmap -x $(pidof %s) | tail -n +3", g->name);
 29  int nmatch = 0;
 30
 31  while (fscanf(fp, "%lx", &start) == 1) {
 32    fscanf(fp, "%ld%*ld%*ld%s%*[^\n]s", &kb, perm);
 33    if (perm[1] != 'w') continue;  // Non-writable areas
 34
 35    uintptr_t size = kb * 1024;
 36    char *mem = calloc(size + 16, 1);  // Ignores error handling for brevity
 37                                       // Don't do this in production!
 38    lseek(g->memfd, start, SEEK_SET);  
 39    size = read(g->memfd, mem, size);
 40
 41    printf("Scanning %lx--%lx\n", start, start + size);
 42
 43    if (!g->has_watch) {
 44      // First-time search; scan all memory
 45      for (int off = 0; off < size; off += 2) {
 46        uint64_t v = mem_load(mem, off, g->bits);
 47        if (v == val && nmatch < MAX_WATCH) {
 48          g->watch[nmatch++] = start + off;
 49        }
 50      }
 51    } else {
 52      // Search in the watched values
 53      for (int i = 0; i < MAX_WATCH; i++) {
 54        intptr_t off = g->watch[i] - start;
 55        if (g->watch[i] && 0 <= off && off < size) {
 56          uint64_t v = mem_load(mem, off, g->bits);
 57          if (v == val) nmatch++;
 58          else g->watch[i] = 0;
 59        }
 60      }
 61    }
 62    free(mem);
 63  }
 64  pclose(fp);
 65
 66  if (nmatch > 0) {
 67    g->has_watch = true;
 68  }
 69  printf("There are %d match(es).\n", nmatch);
 70}
 71
 72void overwrite(struct game *g, uint64_t val) {
 73  int nwrite = 0;
 74  for (int i = 0; i < MAX_WATCH; i++)
 75    if (g->watch[i]) {
 76      lseek(g->memfd, g->watch[i], SEEK_SET);
 77      write(g->memfd, &val, g->bits / 8);
 78      nwrite++;
 79    }
 80  printf("%d value(s) written.\n", nwrite);
 81}
 82
 83void reset(struct game *g) {
 84  for (int i = 0; i < MAX_WATCH; i++) {
 85    g->watch[i] = 0;
 86  }
 87  g->has_watch = false;
 88  printf("Search for %d-bit values in %s.\n", g->bits, g->name);
 89}
 90
 91int load_game(struct game *g, const char *name) {
 92  FILE *pid_fp;
 93  int ret = 0;
 94
 95  g->name = name;
 96  g->bits = 32;
 97  reset(g);
 98
 99  pid_fp = popens("pidof %s", g->name);
100  if (fscanf(pid_fp, "%d", &g->pid) != 1) {
101    fprintf(stderr, "Panic: fail to get pid of \"%s\".\n", g->name);
102    ret = -1;
103    goto release;
104  }
105
106  char buf[64];
107  snprintf(buf, sizeof(buf), "/proc/%d/mem", g->pid);
108  g->memfd = open(buf, O_RDWR);
109  if (g->memfd < 0) {
110    perror("/proc/[pid]/mem");
111    ret = -1;
112    goto release;
113  }
114
115release:
116  if (pid_fp) pclose(pid_fp);
117  return ret;
118}
119
120void close_game(struct game *g) {
121  if (g->memfd >= 0) {
122    close(g->memfd);
123  }
124}
125
126int main(int argc, char *argv[]) {
127  long val;
128  char buf[64];
129  struct game game;
130
131  if (load_game(&game, argv[1]) < 0) {
132    goto release;
133  }
134
135  while (!feof(stdin)) {
136    printf("(%s %d) ", game.name, game.pid);
137    if (scanf("%s", buf) <= 0) goto release;
138
139    switch (buf[0]) {
140      case 'q': goto release; break;
141      case 'b': scanf("%ld", &val); game.bits = val; reset(&game); break;
142      case 's': scanf("%ld", &val); scan(&game, val); break;
143      case 'w': scanf("%ld", &val); overwrite(&game, val); break;
144      case 'r': reset(&game); break;
145    }
146  }
147
148release:
149  close_game(&game);
150  return 0;
151}
152
153FILE* popens(const char* fmt, ...) {
154  char cmd[128];
155  va_list args;
156  va_start(args, fmt);
157  vsnprintf(cmd, sizeof(cmd), fmt, args);
158  va_end(args);
159  FILE *ret = popen(cmd, "r");
160  assert(ret);
161  return ret;
162}
163
164uint64_t mem_load(char *mem, int off, int bits) {
165  uint64_t val = *(uint64_t *)(&mem[off]);
166  switch (bits) {
167    case 16: val &= 0xffff; break;
168    case 32: val &= 0xffffffff; break;
169    case 64: break;
170    default: assert(0);
171  }
172  return val;
173}
17. Linux 进程的地址空间¶

Take-away Messages¶

课后习题/编程作业¶

1. 阅读材料¶

2. 编程实践¶
