Skip to content

Instantly share code, notes, and snippets.

@jtripper
Last active October 30, 2018 00:09
Show Gist options
  • Save jtripper/4605858 to your computer and use it in GitHub Desktop.
Save jtripper/4605858 to your computer and use it in GitHub Desktop.
ptrace roulette
#include <stdio.h>
#include <stdlib.h>
#include <dirent.h>
#include <sys/types.h>
#include <regex.h>
#include <string.h>
#include <sys/ptrace.h>
#include <time.h>
#include <unistd.h>
int *get_proc_ids() {
int *pid_list = (int*)malloc(sizeof(int) * 2);
pid_list[0] = 1;
regex_t preg;
regcomp(&preg, "^[0-9]+$", REG_EXTENDED);
struct dirent *dir;
DIR *d = opendir("/proc");
while ((dir = readdir(d)) != NULL) {
if (!regexec(&preg, dir->d_name, 0, NULL, 0)) {
pid_list[pid_list[0]] = atoi(dir->d_name);
pid_list[0]++;
pid_list = (int*)realloc(pid_list, (pid_list[0] + 1) * sizeof(int));
}
}
closedir(d);
return pid_list;
}
int main() {
int *pid_list, pid, my_pid = getpid();
void *address = 0x0000000;
pid_list = get_proc_ids();
srand(time(NULL));
FILE *urandom = fopen("/dev/urandom", "rb");
int gen;
for(;;) {
fscanf(urandom, "%d", gen);
pid = pid_list[gen % pid_list[0] + 1];
if (pid == my_pid)
continue;
ptrace(PTRACE_ATTACH, pid, NULL, NULL);
fscanf(urandom, "%ld", address);
ptrace(PTRACE_POKEDATA, pid, address, ~ptrace(PTRACE_PEEKDATA, pid, address, NULL));
ptrace(PTRACE_DETACH, pid, NULL, NULL);
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment