  1#include <stdio.h>
  2#include <stdlib.h>
  3#include <assert.h>
  4#include <stdint.h>
  5#include <unistd.h>
  6#include <stdbool.h>
  7#include <stdarg.h>
  8#include <fcntl.h>
  9
 10#define MAX_WATCH 65536
 11
 12struct game {
 13  const char *name;  // Name of the binary
 14  int pid;           // Process ID
 15
 16  int memfd;         // Address space of the process
 17  int bits;          // Search bit-width (16, 32, or 64)
 18  bool has_watch;    // Watched values
 19  uintptr_t watch[MAX_WATCH];
 20};
 21
 22FILE* popens(const char* fmt, ...);
 23uint64_t mem_load(char *mem, int off, int bits);
 24
 25void scan(struct game *g, uint32_t val) {
 26  uintptr_t start, kb;
 27  char perm[16];
 28  FILE *fp = popens("pmap -x $(pidof %s) | tail -n +3", g->name);
 29  int nmatch = 0;
 30
 31  while (fscanf(fp, "%lx", &start) == 1) {
 32    fscanf(fp, "%ld%*ld%*ld%s%*[^\n]s", &kb, perm);
 33    if (perm[1] != 'w') continue;  // Non-writable areas
 34
 35    uintptr_t size = kb * 1024;
 36    char *mem = calloc(size + 16, 1);  // Ignores error handling for brevity
 37    lseek(g->memfd, start, SEEK_SET);  // Don't do this in production!
 38    size = read(g->memfd, mem, size);
 39
 40    printf("Scanning %lx--%lx\n", start, start + size);
 41
 42    if (!g->has_watch) {
 43      // First-time search; scan all memory
 44      for (int off = 0; off < size; off += 2) {
 45        uint64_t v = mem_load(mem, off, g->bits);
 46        if (v == val && nmatch < MAX_WATCH) {
 47          g->watch[nmatch++] = start + off;
 48        }
 49      }
 50    } else {
 51      // Search in the watched values
 52      for (int i = 0; i < MAX_WATCH; i++) {
 53        intptr_t off = g->watch[i] - start;
 54        if (g->watch[i] && 0 <= off && off < size) {
 55          uint64_t v = mem_load(mem, off, g->bits);
 56          if (v == val) nmatch++;
 57          else g->watch[i] = 0;
 58        }
 59      }
 60    }
 61    free(mem);
 62  }
 63  pclose(fp);
 64
 65  if (nmatch > 0) {
 66    g->has_watch = true;
 67  }
 68  printf("There are %d match(es).\n", nmatch);
 69}
 70
 71void overwrite(struct game *g, uint64_t val) {
 72  int nwrite = 0;
 73  for (int i = 0; i < MAX_WATCH; i++)
 74    if (g->watch[i]) {
 75      lseek(g->memfd, g->watch[i], SEEK_SET);
 76      write(g->memfd, &val, g->bits / 8);
 77      nwrite++;
 78    }
 79  printf("%d value(s) written.\n", nwrite);
 80}
 81
 82void reset(struct game *g) {
 83  for (int i = 0; i < MAX_WATCH; i++) {
 84    g->watch[i] = 0;
 85  }
 86  g->has_watch = false;
 87  printf("Search for %d-bit values in %s.\n", g->bits, g->name);
 88}
 89
 90int load_game(struct game *g, const char *name) {
 91  FILE *pid_fp;
 92  int ret = 0;
 93
 94  g->name = name;
 95  g->bits = 32;
 96  reset(g);
 97
 98  pid_fp = popens("pidof %s", g->name);
 99  if (fscanf(pid_fp, "%d", &g->pid) != 1) {
100    fprintf(stderr, "Panic: fail to get pid of \"%s\".\n", g->name);
101    ret = -1;
102    goto release;
103  }
104
105  char buf[64];
106  snprintf(buf, sizeof(buf), "/proc/%d/mem", g->pid);
107  g->memfd = open(buf, O_RDWR);
108  if (g->memfd < 0) {
109    perror("/proc/[pid]/mem");
110    ret = -1;
111    goto release;
112  }
113
114release:
115  if (pid_fp) pclose(pid_fp);
116  return ret;
117}
118
119void close_game(struct game *g) {
120  if (g->memfd >= 0) {
121    close(g->memfd);
122  }
123}
124
125int main(int argc, char *argv[]) {
126  long val;
127  char buf[64];
128  struct game game;
129
130  if (load_game(&game, argv[1]) < 0) {
131    goto release;
132  }
133
134  while (!feof(stdin)) {
135    printf("(%s %d) ", game.name, game.pid);
136    if (scanf("%s", buf) <= 0) goto release;
137
138    switch (buf[0]) {
139      case 'q': goto release; break;
140      case 'b': scanf("%ld", &val); game.bits = val; reset(&game); break;
141      case 's': scanf("%ld", &val); scan(&game, val); break;
142      case 'w': scanf("%ld", &val); overwrite(&game, val); break;
143      case 'r': reset(&game); break;
144    }
145  }
146
147release:
148  close_game(&game);
149  return 0;
150}
151
152FILE* popens(const char* fmt, ...) {
153  char cmd[128];
154  va_list args;
155  va_start(args, fmt);
156  vsnprintf(cmd, sizeof(cmd), fmt, args);
157  va_end(args);
158  FILE *ret = popen(cmd, "r");
159  assert(ret);
160  return ret;
161}
162
163uint64_t mem_load(char *mem, int off, int bits) {
164  uint64_t val = *(uint64_t *)(&mem[off]);
165  switch (bits) {
166    case 16: val &= 0xffff; break;
167    case 32: val &= 0xffffffff; break;
168    case 64: break;
169    default: assert(0);
170  }
171  return val;
172}
17. Linux 进程的地址空间¶

Take-away Messages¶

课后习题/编程作业¶

1. 阅读材料¶

2. 编程实践¶
