ptrace roulette

ptrace_roulette.c

#include <stdio.h>
#include <stdlib.h>
#include <dirent.h>
#include <sys/types.h>
#include <regex.h>
#include <string.h>
#include <sys/ptrace.h>
#include <time.h>
#include <unistd.h>

int *get_proc_ids() {
  int *pid_list = (int*)malloc(sizeof(int) * 2);
  pid_list[0] = 1;

  regex_t preg;
  regcomp(&preg, "^[0-9]+$", REG_EXTENDED);

  struct dirent *dir;

  DIR *d = opendir("/proc");

  while ((dir = readdir(d)) != NULL) {
    if (!regexec(&preg, dir->d_name, 0, NULL, 0)) {
      pid_list[pid_list[0]] = atoi(dir->d_name);
      pid_list[0]++;
      pid_list = (int*)realloc(pid_list, (pid_list[0] + 1) * sizeof(int));
    }
  }

  closedir(d);

  return pid_list;
}

int main() {
  int *pid_list, pid, my_pid = getpid();
  void *address = 0x0000000;
  pid_list = get_proc_ids();
  srand(time(NULL));
  FILE *urandom = fopen("/dev/urandom", "rb");
  int gen;

  for(;;) {
    fscanf(urandom, "%d", gen);
    pid = pid_list[gen % pid_list[0] + 1];

    if (pid == my_pid) 
      continue;

    ptrace(PTRACE_ATTACH, pid, NULL, NULL);
    fscanf(urandom, "%ld", address);
    ptrace(PTRACE_POKEDATA, pid, address, ~ptrace(PTRACE_PEEKDATA, pid, address, NULL));
    ptrace(PTRACE_DETACH, pid, NULL, NULL);
  }
}