Skip to content

Instantly share code, notes, and snippets.

@alfonmga
Created February 12, 2021 11:37
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save alfonmga/4c58e40ff2933ce1b18b51cc13cf992c to your computer and use it in GitHub Desktop.
Save alfonmga/4c58e40ff2933ce1b18b51cc13cf992c to your computer and use it in GitHub Desktop.
Check if given process PID has been executed from memory (memfd_create)
#include <unistd.h>
#include <stdio.h>
#include <string.h>
#include <sys/stat.h>
/*
* Checks if it's our target process
*/
static int is_our_target_process(int pid)
{
char procExe[256];
snprintf(procExe, sizeof(procExe), "/proc/%d/exe", pid);
struct stat lstat_buf;
int x;
x = lstat(procExe, &lstat_buf);
if (S_ISLNK(lstat_buf.st_mode))
{
char linkPath[1024];
size_t len;
if ((len = readlink(procExe, linkPath, sizeof(linkPath) - 1)) != -1)
{
linkPath[len] = '\0';
if (strcmp("/memfd: (deleted)", linkPath) == 0)
{
return 1;
}
}
}
return 0;
}
int main(void)
{
int pid = 876;
printf("is_our_target_process: %d\n", is_our_target_process(pid));
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment