Problem reading procfs

SimoneB · 12-11-2007, 03:25 PM

Hi, I'm developing an application that access the procfs and then
read/write /proc/<PID>/mem of a process to change the content of a file
owned by that process.

The sequential steps performed by the application are the followings:

1) catch, by using ptrace, of the "read" system call
2) read the file content directly on /proc/PID/mem
3) modify this content
4) write back the modified content on /proc/PD/mem

The problem is that it returns "Error 22 Invalid argument" every time
it tries to read (or write) on procfs.
(I've already patched the kernel to allow read/write operation on
/proc/<pid>/mem and I've tried the pread/pwrite functions, but they
have the same behavior).

This is an extract of my code:

Quote:

...
int eax_reg, ecx_reg, ret;
char * buffer;
char orig_buf[eax_reg+1];
char proc_path[MAX_FILE_NAME+1];

// traced_proc is the pid_t of the traced process
// get number of bytes to read
eax_reg = ptrace(PTRACE_PEEKUSER, traced_proc, 4*EAX, NULL);
// get traced process space buffer
ecx_reg = ptrace(PTRACE_PEEKUSER, traced_proc, 4*ECX, NULL);

buffer = malloc(sizeof(char)*eax_reg);
memset(orig_buf,0,eax_reg+1);
memset(proc_path, 0, sizeof(proc_path));

sprintf(proc_path, "/proc/%d/mem", traced_proc);
fd_proc = open(proc_path, O_RDWR);

lseek(fd_proc, ecx_reg, SEEK_SET);
int ret = read(fd_proc, buffer, eax_reg);
if (ret < 0) {
perror("read");
fprintf(stderr, "Failed to read: %d - %s\n", errno, strerror(errno));
}
...

if I run the application with strace, the output for the code shown above is:

Quote:

open("/proc/13271/mem", O_RDWR) = 3
lseek(3, 3086368768, SEEK_SET) = 3086368768
read(3, 0xbfca0940, 280) = -1 EINVAL (Invalid argument)

Can someone tell me where I'm wrong?
Thanks in advance for any help...

David1357 · 12-11-2007, 04:28 PM

Quote:

Originally Posted by SimoneB

Code:

char orig_buf[eax_reg+1];

At this point, eax_reg is unintialized. Compile with "-Wall -Werror" to convert warnings about this into errors.

Quote:

Originally Posted by SimoneB

Code:

eax_reg = ptrace(PTRACE_PEEKUSER, traced_proc, 4*EAX, NULL);

You initialize eax_reg here to a different value than whatever random garbage it originally had.

Quote:

Originally Posted by SimoneB

Code:

memset(orig_buf,0,eax_reg+1);

You probably trash your stack here. You can easily check this by printing out the value of "buffer" before and after this call.

SimoneB · 12-12-2007, 01:55 AM

First of all, thank you for your reply.

eax_reg is initialized to 0 before the "char orig_buf[eax_reg+1];" line (the code that I reported here is only an extract of the actual application, sorry for the misunderstanding...).

David1357 · 12-12-2007, 07:56 AM

Quote:

Originally Posted by SimoneB

eax_reg is initialized to 0 before the "char orig_buf[eax_reg+1];" line (the code that I reported here is only an extract of the actual application, sorry for the misunderstanding...).

You are still probably smashing your stack variables with the memset, because the value of eax_reg is non-zero in the memset.