Skip to content

Commit

Permalink
ultask: Add run_jmp() to impl --jmp
Browse files Browse the repository at this point in the history
Signed-off-by: Rong Tao <rtoax@foxmail.com>
  • Loading branch information
Rtoax committed Jan 4, 2025
1 parent b19abc0 commit 34a8c7e
Showing 1 changed file with 50 additions and 42 deletions.
92 changes: 50 additions & 42 deletions src/ultask.c
Original file line number Diff line number Diff line change
Expand Up @@ -733,6 +733,55 @@ static void list_all_symbols(void)
}
}

int run_jmp(void)
{
int err = 0;
struct vm_area_struct *vma_from, *vma_to;
size_t n, insn_sz;
char *new_insn;
struct jmp_table_entry jmp_entry;
char buf[sizeof(struct jmp_table_entry)] = {};

if (!jmp_addr_from || !jmp_addr_to)
return 0;

vma_from = find_vma(target_task, jmp_addr_from);
vma_to = find_vma(target_task, jmp_addr_to);
if (!vma_from || !vma_to) {
fprintf(stderr,
"0x%lx ot 0x%lx not in process address space\n"
"check with /proc/%d/maps or gdb.\n",
jmp_addr_from, jmp_addr_to, target_pid);
err = -ENOENT;
goto done;
}

jmp_entry.jmp = arch_jmp_table_jmp();
jmp_entry.addr = jmp_addr_to;
new_insn = (void *)&jmp_entry;
insn_sz = sizeof(struct jmp_table_entry);

n = memcpy_from_task(target_task, buf, jmp_addr_from, insn_sz);
if (n == -1 || n < insn_sz) {
ulp_error("failed read target process.\n");
err = -ENOMEM;
goto done;
}

fprintf(stdout, "Original data bytes: ");
fmembytes(stdout, buf, insn_sz);

n = memcpy_to_task(target_task, jmp_addr_from, new_insn,
insn_sz);
if (n == -1 || n < insn_sz) {
ulp_error("failed kick target process.\n");
err = -ENOMEM;
goto done;
}
done:
return err;
}

int ultask(int argc, char *argv[])
{
int ret = 0;
Expand Down Expand Up @@ -800,47 +849,7 @@ int ultask(int argc, char *argv[])
if (flag_print_fds)
dump_task_fds(stdout, target_task, is_verbose());

if (jmp_addr_from && jmp_addr_to) {
struct vm_area_struct *vma_from, *vma_to;
vma_from = find_vma(target_task, jmp_addr_from);
vma_to = find_vma(target_task, jmp_addr_to);
if (!vma_from || !vma_to) {
fprintf(stderr,
"0x%lx ot 0x%lx not in process address space\n"
"check with /proc/%d/maps or gdb.\n",
jmp_addr_from, jmp_addr_to, target_pid);
ret = -1;
goto done;
}
size_t n, insn_sz;
char *new_insn;
struct jmp_table_entry jmp_entry;

jmp_entry.jmp = arch_jmp_table_jmp();
jmp_entry.addr = jmp_addr_to;
new_insn = (void *)&jmp_entry;
insn_sz = sizeof(struct jmp_table_entry);

char buf[sizeof(struct jmp_table_entry)] = {};

n = memcpy_from_task(target_task, buf, jmp_addr_from, insn_sz);
if (n == -1 || n < insn_sz) {
ulp_error("failed read target process.\n");
ret = -1;
goto done;
}

fprintf(stdout, "Original data bytes: ");
fmembytes(stdout, buf, insn_sz);

n = memcpy_to_task(target_task, jmp_addr_from, new_insn,
insn_sz);
if (n == -1 || n < insn_sz) {
ulp_error("failed kick target process.\n");
ret = -1;
goto done;
}
}
run_jmp();

if (disasm_addr && disasm_size) {
void *mem = malloc(disasm_size);
Expand All @@ -857,7 +866,6 @@ int ultask(int argc, char *argv[])
free(mem);
}

done:
close_task(target_task);
return ret;
}
Expand Down

0 comments on commit 34a8c7e

Please sign in to comment.