Giters

vikasnkumar / hotpatch

Hot patching executables on Linux using .so file injection

Home Page:http://www.selectiveintellect.com/hotpatch.html

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

fail to run test

fjzzhongyi opened this issue · comments

commented

Hi, I tried to run as commands written in README, i,e., bash> ./hotpatcher -l ./libhotpatchtest.so -s mysym -v1 $$; but this invocation of injection didn't create any file nor write anything.
The following is standard output from my bash.

Options Given:
Verbose Level: 1
Process PID: 3840
Symbol name: mysym
Library name: ./libhotpatchtest.so
Dry run: false
[ld_load_maps:278] Max number of mappings present: 53
[ld_find_library:440] Found entry /lib/x86_64-linux-gnu/ld-2.27.so matching /lib64/ld-linux-x86-64.so.2
[ld_find_library:376] Doing best substring search for libc.
[ld_find_library:440] Found entry /lib/x86_64-linux-gnu/libc-2.27.so matching libc
[ld_find_library:376] Doing best substring search for libdl.
[ld_find_library:440] Found entry /lib/x86_64-linux-gnu/libdl-2.27.so matching libdl
[ld_find_library:376] Doing best substring search for libpthread.
[ld_find_library:447] Library libpthread not found in procmaps
[hotpatch_gather_functions:104] libpthread not mapped.
[hotpatch_gather_functions:106] Found malloc at 0x7f8d8b5fb070 in libc
[hotpatch_gather_functions:107] Found realloc at 0x7f8d8b5fcc30 in libc
[hotpatch_gather_functions:108] Found free at 0x7f8d8b5fb950 in libc
[hotpatch_gather_functions:122] Found dlopen at 0x7f8d8b955fe0 in libdl
[hotpatch_gather_functions:123] Found dlclose at 0x7f8d8b956080 in libdl
[hotpatch_gather_functions:124] Found dlsym at 0x7f8d8b9560f0 in libdl
[hotpatch_inject_library:620] Allocating 1024 bytes in the target.
[hotpatch_inject_library:741] Dll opened at 0x55b287077a30
[hotpatch_inject_library:755] Symbol mysym found at 0x7f8d89f4f5ad
[hotpatch_inject_library:769] Return value from invoking mysym(): (nil)
Dll was injected at 0x55b287077a30
Invocation of mysym() returned (nil)

Could anyone help me out of this trap?

commented
commented
commented
commented

I follow instructions to set ptrace_scope to 0 which enforces no restriction to ptrace. However, it doesn't work still. Would other issues claim it? And it notes that the standard output is a little different. I just attach it here.

Options Given:
Verbose Level: 1
Process PID: 3053
Symbol name: mysym
Library name: ./libhotpatchtest.so
Dry run: false
[ld_load_maps:278] Max number of mappings present: 50
[ld_find_library:440] Found entry /lib/x86_64-linux-gnu/ld-2.27.so matching /lib64/ld-linux-x86-64.so.2
[ld_find_library:376] Doing best substring search for libc.
[ld_find_library:440] Found entry /lib/x86_64-linux-gnu/libc-2.27.so matching libc
[ld_find_library:376] Doing best substring search for libdl.
[ld_find_library:440] Found entry /lib/x86_64-linux-gnu/libdl-2.27.so matching libdl
[ld_find_library:376] Doing best substring search for libpthread.
[ld_find_library:447] Library libpthread not found in procmaps
[hotpatch_gather_functions:104] libpthread not mapped.
[hotpatch_gather_functions:106] Found malloc at 0x7fee7ede7070 in libc
[hotpatch_gather_functions:107] Found realloc at 0x7fee7ede8c30 in libc
[hotpatch_gather_functions:108] Found free at 0x7fee7ede7950 in libc
[hotpatch_gather_functions:122] Found dlopen at 0x7fee7f141fe0 in libdl
[hotpatch_gather_functions:123] Found dlclose at 0x7fee7f142080 in libdl
[hotpatch_gather_functions:124] Found dlsym at 0x7fee7f1420f0 in libdl
[hotpatch_inject_library:620] Allocating 1024 bytes in the target.
[hotpatch_inject_library:741] Dll opened at 0x55db6da03e70
[hotpatch_inject_library:755] Symbol mysym found at 0x7fee7d93d5ad
[hotpatch_inject_library:769] Return value from invoking mysym(): (nil)
Dll was injected at 0x55db6da03e70
Invocation of mysym() returned (nil)

In Ubuntu, ptrace is blocked as a security feature. More details here under ptrace scope section: https://wiki.ubuntu.com/Security/Features You have to turn the security feature off for Hotpatch to work on Ubuntu. Other versions do not have this problem. The behavior is controllable through the /proc/sys/kernel/yama/ptrace_scope Sysctl. You can toggle that value to see if it works.
…
-- Vikas Kumar vikas@vikaskumar.org
On Tue, Jan 7, 2020, at 7:05 AM, fjzzhongyi wrote: I run the command and the response is as follows: No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 18.04.1 LTS Release: 18.04 Codename: bionic I had tried to run it using "sudo". On 2020/1/7 下午7:42, Vikas N Kumar wrote: > Hi > Can you specify OS details here using lsb_release -a ? Ubuntu > specifically blocks this nowadays using some kernel parameters in > /proc so you have to use root to allow for ptrace() to work. > > > -- > Vikas Kumar > > > > > On Tue, Jan 7, 2020, at 4:10 AM, fjzzhongyi wrote: > > > > > Hi, I tried to run as commands written in README, i,e., bash> > ./hotpatcher -l ./libhotpatchtest.so -s mysym -v1 $$; but this > invocation of injection didn't create any file nor write anything. > > The following is standard output from my bash. > > > > > Options Given: > Verbose Level: 1 > Process PID: 3840 > Symbol name: mysym > Library name: ./libhotpatchtest.so > Dry run: false > [ld_load_maps:278] Max number of mappings present: 53 > [ld_find_library:440] Found entry /lib/x86_64-linux-gnu/ld-2.27.so > matching /lib64/ld-linux-x86-64.so.2 > [ld_find_library:376] Doing best substring search for libc. > [ld_find_library:440] Found entry /lib/x86_64-linux-gnu/libc-2.27.so > matching libc > [ld_find_library:376] Doing best substring search for libdl. > [ld_find_library:440] Found entry /lib/x86_64-linux-gnu/libdl-2.27.so > matching libdl > [ld_find_library:376] Doing best substring search for libpthread. > [ld_find_library:447] Library libpthread not found in procmaps > [hotpatch_gather_functions:104] libpthread not mapped. > [hotpatch_gather_functions:106] Found malloc at 0x7f8d8b5fb070 in libc > [hotpatch_gather_functions:107] Found realloc at 0x7f8d8b5fcc30 in libc > [hotpatch_gather_functions:108] Found free at 0x7f8d8b5fb950 in libc > [hotpatch_gather_functions:122] Found dlopen at 0x7f8d8b955fe0 in libdl > [hotpatch_gather_functions:123] Found dlclose at 0x7f8d8b956080 in libdl > [hotpatch_gather_functions:124] Found dlsym at 0x7f8d8b9560f0 in libdl > [hotpatch_inject_library:620] Allocating 1024 bytes in the target. > [hotpatch_inject_library:741] Dll opened at 0x55b287077a30 > [hotpatch_inject_library:755] Symbol mysym found at 0x7f8d89f4f5ad > [hotpatch_inject_library:769] Return value from invoking mysym(): (nil) > Dll was injected at 0x55b287077a30 > Invocation of mysym() returned (nil) > > > > Could anyone help me out of this trap? > > > — > > You are receiving this because you are subscribed to this thread. > > Reply to this email directly, view it on GitHub > <#17?email_source=notifications&email_token=AAAC6WCCY2UUPE53YWERV33Q4RBIHA5CNFSM4KDVHUT2YY3PNVWWK3TUL52HS4DFUVEXG43VMWVGG33NNVSW45C7NFSM4IEN2LWQ>, > or unsubscribe > https://github.com/notifications/unsubscribe-auth/AAAC6WH5C5NVSJWY7C2EFG3Q4RBIHANCNFSM4KDVHUTQ. > > — > You are receiving this because you authored the thread. > Reply to this email directly, view it on GitHub > <#17?email_source=notifications&email_token=ABXRQM2AUXOEMOUAVH4CAFLQ4RTEHA5CNFSM4KDVHUT2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEIITMMA#issuecomment-571553328>, > or unsubscribe > https://github.com/notifications/unsubscribe-auth/ABXRQM254SVKV6BH45YNCCLQ4RTEHANCNFSM4KDVHUTQ. > — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#17?email_source=notifications&email_token=AAAC6WHRPVZI52D2JEJHIATQ4RVYVA5CNFSM4KDVHUT2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEIIVAUI#issuecomment-571560017>, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAAC6WHESP2CLS7TUI3BV63Q4RVYVANCNFSM4KDVHUTQ.

commented
commented

However, I can't find any modification to tmp/hotpatchtest.log even if I have specified absolute path and created this file in advance. I applied my own program, but it seems not in line with expectations.

This looks like it succeeded.
-- Vikas Kumar vikas@vikaskumar.org
On Tue, Jan 7, 2020, at 11:27 PM, fjzzhongyi wrote: I follow instructions to set ptrace_scope to 0 which enforces no restriction to ptrace. However, it doesn't work still. Would other issues claim it? And it notes that the standard output is a little different. I just attach it here. Options Given: Verbose Level: 1 Process PID: 3053 Symbol name: mysym Library name: ./libhotpatchtest.so Dry run: false [ld_load_maps:278] Max number of mappings present: 50 [ld_find_library:440] Found entry /lib/x86_64-linux-gnu/ld-2.27.so matching /lib64/ld-linux-x86-64.so.2 [ld_find_library:376] Doing best substring search for libc. [ld_find_library:440] Found entry /lib/x86_64-linux-gnu/libc-2.27.so matching libc [ld_find_library:376] Doing best substring search for libdl. [ld_find_library:440] Found entry /lib/x86_64-linux-gnu/libdl-2.27.so matching libdl [ld_find_library:376] Doing best substring search for libpthread. [ld_find_library:447] Library libpthread not found in procmaps [hotpatch_gather_functions:104] libpthread not mapped. [hotpatch_gather_functions:106] Found malloc at 0x7fee7ede7070 in libc [hotpatch_gather_functions:107] Found realloc at 0x7fee7ede8c30 in libc [hotpatch_gather_functions:108] Found free at 0x7fee7ede7950 in libc [hotpatch_gather_functions:122] Found dlopen at 0x7fee7f141fe0 in libdl [hotpatch_gather_functions:123] Found dlclose at 0x7fee7f142080 in libdl [hotpatch_gather_functions:124] Found dlsym at 0x7fee7f1420f0 in libdl [hotpatch_inject_library:620] Allocating 1024 bytes in the target. [hotpatch_inject_library:741] Dll opened at 0x55db6da03e70 [hotpatch_inject_library:755] Symbol mysym found at 0x7fee7d93d5ad [hotpatch_inject_library:769] Return value from invoking mysym(): (nil) Dll was injected at 0x55db6da03e70 Invocation of mysym() returned (nil)
…

In Ubuntu, ptrace is blocked as a security feature. More details here under ptrace scope section: https://wiki.ubuntu.com/Security/Features You have to turn the security feature off for Hotpatch to work on Ubuntu. Other versions do not have this problem. The behavior is controllable through the /proc/sys/kernel/yama/ptrace_scope Sysctl. You can toggle that value to see if it works. > … <#> > -- Vikas Kumar @.*** > On Tue, Jan 7, 2020, at 7:05 AM, fjzzhongyi wrote: I run the command and the response is as follows: No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 18.04.1 LTS Release: 18.04 Codename: bionic I had tried to run it using "sudo". On 2020/1/7 下午7:42, Vikas N Kumar wrote: > Hi > Can you specify OS details here using lsb_release -a ? Ubuntu > specifically blocks this nowadays using some kernel parameters in > /proc so you have to use root to allow for ptrace() to work. > > > -- > Vikas Kumar > > > > > On Tue, Jan 7, 2020, at 4:10 AM, fjzzhongyi wrote: > > > > > Hi, I tried to run as commands written in README, i,e., bash> > ./hotpatcher -l ./libhotpatchtest.so -s mysym -v1 $$; but this > invocation of injection didn't create any file nor write anything. > > The following is standard output from my bash. > > > > > Options Given: > Verbose Level: 1 > Process PID: 3840 > Symbol name: mysym > Library name: ./libhotpatchtest.so > Dry run: false > [ld_load_maps:278] Max number of mappings present: 53 > [ld_find_library:440] Found entry /lib/x86_64-linux-gnu/ld-2.27.so > matching /lib64/ld-linux-x86-64.so.2 > [ld_find_library:376] Doing best substring search for libc. > [ld_find_library:440] Found entry /lib/x86_64-linux-gnu/libc-2.27.so > matching libc > [ld_find_library:376] Doing best substring search for libdl. > [ld_find_library:440] Found entry /lib/x86_64-linux-gnu/libdl-2.27.so > matching libdl > [ld_find_library:376] Doing best substring search for libpthread. > [ld_find_library:447] Library libpthread not found in procmaps > [hotpatch_gather_functions:104] libpthread not mapped. > [hotpatch_gather_functions:106] Found malloc at 0x7f8d8b5fb070 in libc > [hotpatch_gather_functions:107] Found realloc at 0x7f8d8b5fcc30 in libc > [hotpatch_gather_functions:108] Found free at 0x7f8d8b5fb950 in libc > [hotpatch_gather_functions:122] Found dlopen at 0x7f8d8b955fe0 in libdl > [hotpatch_gather_functions:123] Found dlclose at 0x7f8d8b956080 in libdl > [hotpatch_gather_functions:124] Found dlsym at 0x7f8d8b9560f0 in libdl > [hotpatch_inject_library:620] Allocating 1024 bytes in the target. > [hotpatch_inject_library:741] Dll opened at 0x55b287077a30 > [hotpatch_inject_library:755] Symbol mysym found at 0x7f8d89f4f5ad > [hotpatch_inject_library:769] Return value from invoking mysym(): (nil) > Dll was injected at 0x55b287077a30 > Invocation of mysym() returned (nil) > > > > Could anyone help me out of this trap? > > > — > > You are receiving this because you are subscribed to this thread. > > Reply to this email directly, view it on GitHub > <#17 <#17>?email_source=notifications&email_token=AAAC6WCCY2UUPE53YWERV33Q4RBIHA5CNFSM4KDVHUT2YY3PNVWWK3TUL52HS4DFUVEXG43VMWVGG33NNVSW45C7NFSM4IEN2LWQ>, > or unsubscribe > https://github.com/notifications/unsubscribe-auth/AAAC6WH5C5NVSJWY7C2EFG3Q4RBIHANCNFSM4KDVHUTQ. > > — > You are receiving this because you authored the thread. > Reply to this email directly, view it on GitHub > <#17 <#17>?email_source=notifications&email_token=ABXRQM2AUXOEMOUAVH4CAFLQ4RTEHA5CNFSM4KDVHUT2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEIITMMA#issuecomment-571553328>, > or unsubscribe > https://github.com/notifications/unsubscribe-auth/ABXRQM254SVKV6BH45YNCCLQ4RTEHANCNFSM4KDVHUTQ. > — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#17 <#17>?email_source=notifications&email_token=AAAC6WHRPVZI52D2JEJHIATQ4RVYVA5CNFSM4KDVHUT2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEIIVAUI#issuecomment-571560017>, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAAC6WHESP2CLS7TUI3BV63Q4RVYVANCNFSM4KDVHUTQ. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#17?email_source=notifications&email_token=AAAC6WGG3IEU6KFDKFUABGLQ4VI4FA5CNFSM4KDVHUT2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEILEVZY#issuecomment-571886311>, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAAC6WBVW3UV4GGLYRHLTF3Q4VI4FANCNFSM4KDVHUTQ.

commented
commented
commented
commented
commented
commented

May I infer hotpatch is to patch its code to running host process, invoke specific function within patch and return control back to host process? So would these actions be notified to host process? And what interactions could be perform between patch code and host code?

I think Frida solves what you want especially if you have control of the application in question. Hotpatch can only be used to patch functions not variables unless you’re trying to change static variables for which you have the address.
…

commented
commented

OK. It's quite intelligible now. But if process keeps unconscious of the injected library, what would be the most representative cases using hotpatch since it seems to have no influence on running state of injected process?

Yes that’s correct. Hotpatch allows you to inject your code into an already running process. The host process does not get notified unless they explicitly keep checking the list of all the .so files loaded in their memory which almost no process does.
…

commented
commented

Closing since no more requests from developer.