first commit

02_day/ptrace/euidfake.c

@@ -0,0 +1,65 @@
+#include <stdio.h>
+#include <linux/ptrace.h>
+#include <sys/types.h>
+#include <sys/user.h> // or linux/user.h (contains user_regs_struct)
+#include <stdlib.h>
+#include <unistd.h>
+
+void dump_reg(int pid, struct user_regs_struct *regs)
+{
+	if(ptrace(PTRACE_GETREGS, pid, 0, regs)) {
+		perror("PTRACE_GETREGS");
+		exit(1);
+	}
+
+	printf("-------- DUMP OF REGISTERS --------\n");
+	printf("stack ebp = %#x\n", regs->ebp);
+	printf("stack esp = %#x\n", regs->esp);
+	printf("orig_eax  = %#x\n", regs->orig_eax);
+	printf("eax = %#x\n", regs->eax);
+	printf("ebx = %#x\n", regs->ebx);
+	printf("ecx = %#x\n", regs->ecx);
+	printf("edx = %#x\n", regs->edx);
+	printf("eip = %#x\n", regs->eip);
+	printf("------------------------------------\n");
+}
+
+int main(void)
+{
+	int pid, status;
+	struct user_regs_struct regs;
+
+	if(!(pid = fork())) {
+		ptrace(PTRACE_TRACEME, 0, 0, 0); // tracebit set
+		execl( "./geteuid" , "./geteuid" , NULL );
+		return 0;
+	}
+	// child process stand by
+
+	while(1) {
+		wait(&status);
+		if(WIFEXITED(status)) {
+			fprintf(stderr, "child has already exited\n");
+			break;
+		}
+		if(WIFSIGNALED(status)) {
+			fprintf(stderr, "child process %d was abnormal exit.\n", pid);
+			break;
+		}
+
+		// dump general purpose registers
+		dump_reg(pid, &regs);
+		if(regs.orig_eax == 0xc9 && regs.eax == geteuid()) {
+			printf("You'll call geteuid() hereafter\n");
+			ptrace(PTRACE_POKEUSR, pid, EAX*4, 0);
+			printf("EAX has been modified by ptrace()\n");
+			dump_reg(pid, &regs);
+			ptrace(PTRACE_CONT, pid, 0, 0);
+			break;	
+		}
+		// trace until syscall
+		ptrace(PTRACE_SYSCALL, pid, 0, 0);
+	}
+
+	// End of while loop -> child process has exited already.
+}

02_day/ptrace/geteuid.c

@@ -0,0 +1,19 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <sys/types.h>
+int main()
+{
+	char *passwd = "criminal is a gold broker";
+	int euid;
+	euid = geteuid();
+
+	if(euid == 0) { // root
+		printf("You Are Operator!\n");
+		printf("Password is %s\n", passwd);
+		exit(0);
+	}
+
+	printf("You are just a user %d\n", euid);
+	return 0;
+}

02_day/ptrace/hello.c

@@ -0,0 +1,12 @@
+#include <stdio.h>
+#include <unistd.h>
+int main()
+{
+	char str[] = "hello!";
+	while(1)
+	{
+		printf("%s\n", str);
+		sleep(1);
+	}
+}
+

02_day/ptrace/procmem.c

@@ -0,0 +1,54 @@
+#include <stdlib.h>
+#include <stdio.h>
+#include <sys/ptrace.h>
+#include <sys/types.h>
+#include <unistd.h>
+#include <fcntl.h>
+void dump_region(int fd, long start, long end)
+{
+	char buf[4096];
+
+	lseek64(fd, start, SEEK_SET);
+	while(start < end) {
+		int rd;
+
+		rd = read(fd, buf, 4096);
+		write(STDOUT_FILENO, buf, rd);
+		start += 4096;
+	}
+}
+
+int main(int argc, char *argv[])
+{
+	FILE *maps;
+	int mem;
+	pid_t pid;
+	char path[BUFSIZ];
+	if(argc < 2) {
+		fprintf(stderr, "usage: %s pid\n", argv[0]);
+		return EXIT_FAILURE;
+	}
+	pid = strtol(argv[1], NULL, 10);
+	if(ptrace(PTRACE_ATTACH, pid, NULL, NULL) == -1) {
+		perror("ptrace");
+		return EXIT_FAILURE;
+	}
+	snprintf(path, sizeof(path), "/proc/%d/maps", pid);
+	maps = fopen(path, "r");
+	snprintf(path, sizeof(path), "/proc/%d/mem", pid);
+	mem = open(path, O_RDONLY);
+	if(maps && mem != -1) {
+		char buf[BUFSIZ + 1];
+		while(fgets(buf, BUFSIZ, maps)) {
+			long start, end;
+			sscanf(buf, "%llx-%llx", &start, &end);
+			dump_region(mem, start, end);
+		}
+	}
+	ptrace(PTRACE_DETACH, pid, NULL, NULL);
+	if(mem != -1)
+		close(mem);
+	if(maps)
+		fclose(maps);
+	return EXIT_SUCCESS;
+}

02_day/ptrace/ptrace.c

@@ -0,0 +1,21 @@
+#include <sys/ptrace.h>
+#include <sys/user.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+int main(int argc, char *argv[])
+{
+
+	struct user_regs_struct regs;
+
+	int ret, pid, i;
+
+	pid = atoi(argv[1]);
+
+	ret = ptrace(PTRACE_ATTACH, pid, 0, 0);
+
+	printf("return : %d\n", ret);
+
+	ptrace(PTRACE_DETACH, pid, 0, 0);
+}
+

02_day/ptrace/ptrace_1.c

@@ -0,0 +1,28 @@
+#include <sys/ptrace.h>
+#include <sys/user.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+int main(int argc, char *argv[])
+{
+
+	struct user_regs_struct regs;
+	int ret, pid;
+
+	pid = atoi(argv[1]);
+
+
+	ret = ptrace(PTRACE_ATTACH, pid, 0, 0);
+
+	printf("return : %d\n", ret);
+
+
+	ptrace(PTRACE_GETREGS, pid, 0, regs);
+
+	// 스택 주소 출력
+	printf("stack = %p\n", (void*)regs.esp);
+
+
+	ptrace(PTRACE_DETACH, pid, 0, 0);
+}
+

02_day/ptrace/ptrace_2.c

@@ -0,0 +1,27 @@
+#include <sys/ptrace.h>
+#include <sys/user.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+
+int main(int argc, char *argv[])
+{
+	struct user_regs_struct regs;
+	int ret, pid, i;
+	unsigned int data;
+	pid = atoi(argv[1]);
+
+	ret = ptrace(PTRACE_ATTACH, pid, 0, 0);
+	printf("return : %d\n", ret);
+
+	ptrace(PTRACE_GETREGS, pid, 0, regs);
+	printf("stack = %p\n", (void*)regs.esp);
+
+	for(i=0; i<10; i++)
+	{
+		data = ptrace(PTRACE_PEEKDATA, pid, regs.esp+i*4, 0);
+		printf("%08x\n", data);
+	}
+
+	ptrace(PTRACE_DETACH, pid, 0, 0);
+}

02_day/ptrace/ptrace_3.c

@@ -0,0 +1,36 @@
+#include <sys/ptrace.h>
+#include <sys/user.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <ctype.h>
+
+int main(int argc, char *argv[])
+{
+	struct user_regs_struct regs;
+	int ret, pid, i, j;
+	unsigned int data;
+	unsigned char data2[4];
+
+	pid = atoi(argv[1]);
+
+	ret = ptrace(PTRACE_ATTACH, pid, 0, 0);
+	printf("return : %d\n", ret);
+
+	ptrace(PTRACE_GETREGS, pid, 0, &regs);
+	printf("stack = %p\n", (void*)regs.esp);
+
+	for(i=0; i<300; i++)
+	{
+		data = ptrace(PTRACE_PEEKDATA, pid, regs.esp+i*4, 0);
+		memcpy(&data2, &data, 4);
+		for(j=0; j<4; j++){
+			if(isprint(data2[j]))
+				printf("%c ", data2[j]);
+			else
+				printf(". ");
+		}
+	}
+	ptrace(PTRACE_DETACH, pid, 0, 0);
+}
+

02_day/ptrace/ptrace_4.c

@@ -0,0 +1,38 @@
+#include <sys/ptrace.h>
+#include <sys/user.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <ctype.h>
+
+int main(int argc, char *argv[])
+{
+	struct user_regs_struct regs;
+	int ret, pid, i, j;
+	unsigned int data;
+	unsigned char data2[4];
+
+	pid = atoi(argv[1]);
+
+	ret = ptrace(PTRACE_ATTACH, pid, 0, 0);
+	printf("return : %d\n", ret);
+
+	ptrace(PTRACE_GETREGS, pid, 0, &regs);
+	printf("stack = %p\n", (void*)regs.esp);
+
+	for(i=0; i<300; i++)
+	{
+		data = ptrace(PTRACE_PEEKDATA, pid, regs.esp+i*4, 0);
+		memcpy(&data2, &data, 4);
+		printf("%08x : ", (unsigned int)regs.esp+i*4);
+		for(j=0; j<4; j++){
+			if(isprint(data2[j]))
+				printf("%c ", data2[j]);
+			else
+				printf(". ");
+		}
+		printf("\n");
+	}
+	ptrace(PTRACE_DETACH, pid, 0, 0);
+}
+

02_day/ptrace/ptrace_5.c

@@ -0,0 +1,40 @@
+#include <sys/ptrace.h>
+#include <sys/user.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+#include <ctype.h>
+
+int main(int argc, char *argv[])
+{
+	struct user_regs_struct regs;
+	int ret, pid, i, j;
+	unsigned int data;
+	unsigned char data2[4];
+
+	pid = atoi(argv[1]);
+	ret = ptrace(PTRACE_ATTACH, pid, 0, 0);
+	printf("return : %d\n", ret);
+
+	ptrace(PTRACE_GETREGS, pid, 0, &regs);
+	printf("stack = %p\n", (void*)regs.esp);
+
+	for(i=0; i<300; i++)
+	{
+		data = ptrace(PTRACE_PEEKDATA, pid, regs.esp+i*4, 0);
+		memcpy(&data2, &data, 4);
+		printf("%08x : ", (unsigned int)regs.esp+i*4);
+
+		for(j=0; j<4; j++){
+			if(isprint(data2[j]))
+				printf("%c ", data2[j]);
+			else
+				printf(". ");
+		}
+		printf("\n");
+	}
+	ptrace(PTRACE_POKEDATA, pid, 0xbf8b7f65, 0x41414141);
+	ptrace(PTRACE_DETACH, pid, 0, 0);
+}
+
+