Linux内核私闯进程地址空间并修改进程内存的方法

// test.c
// gcc test.c -o test
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/mman.h>

int main()
{
  char* addr = mmap(NULL, 1024, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
  strcpy(addr, "Zhejiang wenzhou pixie shi");

  printf("addr: %lu  pid:%d\n", addr, getpid());

  printf("before:%s \n", addr);

 getchar();

  printf("after:%s\n", addr);

  return 0;
}

// test.c
// make -C /lib/modules/`uname -r`/build SUBDIRS=`pwd` modules
#include <linux/mm.h>
#include <linux/sched.h>
#include <linux/module.h>

static int pid = 1;
module_param(pid, int, 0644);

static unsigned long addr = 0;
module_param(addr, long, 0644);

// 根据一个进程的虚拟地址找到它的页表，相当于找到这家人的房子地址，然后闯入！
static pte_t* get_pte(struct task_struct *task, unsigned long address)
{
 pgd_t* pgd;
 pud_t* pud;
 pmd_t* pmd;
 pte_t* pte;
 struct mm_struct *mm = task->mm;

 pgd = pgd_offset(mm, address);
 if(pgd_none(*pgd) || pgd_bad(*pgd))
 return NULL;

 pud = pud_offset(pgd, address);
 if(pud_none(*pud) || pud_bad(*pud))
 return NULL;

 pmd = pmd_offset(pud, address);
 if(pmd_none(*pmd) || pmd_bad(*pmd))
 return NULL;

 pte = pte_offset_kernel(pmd, address);
 if(pte_none(*pte))
 return NULL;

 return pte;
}

static int test_init(void)
{
 struct task_struct *task;
 pte_t* pte;
 struct page* page;

 // 找到这家人
 task = pid_task(find_pid_ns(pid, &init_pid_ns), PIDTYPE_PID);
 // 找到这家人住在哪里
 if(!(pte = get_pte(task, addr)))
 return -1;

 page = pte_page(*pte);
 // 强行闯入
 addr = page_address(page);
 // sdajgdoiewhgikwnsviwgvwgvw
 strcpy(addr, (char *)"rain flooding water will not get fat!");
 // 事了拂衣去，深藏功与名
 return 0;
}

static void test_exit(void)
{
}

module_init(test_init);
module_exit(test_exit);
MODULE_LICENSE("GPL");

[root@10 page_replace]# ./test
addr: 140338535763968  pid:9912
before:Zhejiang wenzhou pixie shi

[root@10 test]# insmod test.ko pid=9912 addr=140338535763968
[root@10 test]#

[root@10 page_replace]# ./test
addr: 140338535763968  pid:9912
before:Zhejiang wenzhou pixie shi

after:rain flooding water will not get fat!
[root@10 page_replace]#

// getphys.c
// gcc getphys -o getphys
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>

int main(int argc, char **argv)
{
 int fd;
 int pid;
 unsigned long pte;
 unsigned long addr;
 unsigned long phy_addr;
 char procbuf[64] = {0};

 pid = atoi(argv[1]);
 addr = atol(argv[2]);

 sprintf(procbuf, "/proc/%d/pagemap", pid);

 fd = open(procbuf, O_RDONLY);
 size_t offset = (addr/4096) * sizeof(unsigned long);
 lseek(fd, offset, SEEK_SET);

 read(fd, &pte, sizeof(unsigned long));

 phy_addr = (pte & ((((unsigned long)1) << 55) - 1))*4096 + addr%4096;
 printf("phy addr:%lu\n", phy_addr);

 return 0;
}

#include <linux/module.h>

static unsigned long addr = 0;
module_param(addr, long, 0644);

static int test_init(void)
{
 strcpy(phys_to_virt(addr), (char *)"rain flooding water will not get fat!");
 return 0;
}

static void test_exit(void)
{
}

module_init(test_init);
module_exit(test_exit);

MODULE_LICENSE("GPL");