Subject: dumpmem, a toy^H^H^Htool to dump a process's memory

From: Muli Ben-Yehuda <[email-masked]>
Date: Wed, 6 Nov 2002 11:05:03 +0200

check out dumpmem, http://www.mulix.org/code/dumpmem-0.1.tar.gz, a
process memory dumper. 

./dumpmem ls 

will dump the memory image of the ls process after it is exec'd and
before it is run. It's not a very hackish hack in the original sense
of the word, just a ptrace toy. It is a hack in the "hack with an axe"
sense, especially in the parsing of /proc/pid/maps - I've forgotten
how cumbersome and ugly parsing a file in C can be. Spoiled by python
(and perl) I am. 

Comments and patches welcome, of course. Death threats and employment
offers accepted as well. 
-- 
Muli Ben-Yehuda				    http://www.mulix.org/
[email-masked]:~$ sctrace strace /bin/foo  http://syscalltrack.sf.net/
Quis custodes ipsos custodiet?              http://www.mulix.org/cv.html

---

From: Muli Ben-Yehuda <[email-masked]>
Date: Wed, 6 Nov 2002 11:17:23 +0200

> check out dumpmem, http://www.mulix.org/code/dumpmem-0.1.tar.gz, a

Proving once again that I should buy stock in companies producing
brown paper bags, http://www.mulix.org/code/dumpmem-0.2.tar.gz fixes
an embarassing Makefile bug and makes dumpmem tarball actually build. 

Actually, the reasons for the embarassing bug might make an
interesting post. In a bit. 
-- 
Muli Ben-Yehuda				    http://www.mulix.org/
[email-masked]:~$ sctrace strace /bin/foo  http://syscalltrack.sf.net/
Quis custodes ipsos custodiet?              http://www.mulix.org/cv.html

---

From: "Nadav Har'El" <[email-masked]>
Date: Wed, 6 Nov 2002 13:00:28 +0200

> before it is run. It's not a very hackish hack in the original sense

Can you give an example of some uses of this tool?

-- 
Nadav Har'El                        |     Wednesday, Nov 6 2002, 1 Kislev 5763
[email-masked]             |-----------------------------------------
Phone: +972-53-245868, ICQ 13349191 |The space between my ears was
http://nadav.harel.org.il           |intentionally left blank.

---

From: Gilad Ben-Yossef <[email-masked]>
Date: 06 Nov 2002 14:49:35 +0200

> Can you give an example of some uses of this tool?

Stenography. ;-)

Gilad.

-- 
 Gilad Ben-Yossef <[email-masked]> 
 http://benyossef.com 
 "Denial really is a river in Eygept."

---

From: Muli Ben-Yehuda <[email-masked]>
Date: Wed, 6 Nov 2002 15:31:40 +0200

> Can you give an example of some uses of this tool?

Right now, it's a toy. If developed further, it could be used for
disassembling a program in memory, or for searching a program's memory
space for sensitive data. Other uses include debugging and taking a
snapshot of a program's memory - now that I think of it, it might be
posssible to implement a limited exec() completely in userspace, by
replacing the process's memory contents with the memory contents of
another process. It will certainly be possible to do self modifying
code tricks. Quite enough for a toy, isn't it? ;-)
-- 
Muli Ben-Yehuda				    http://www.mulix.org/
[email-masked]:~$ sctrace strace /bin/foo  http://syscalltrack.sf.net/
Quis custodes ipsos custodiet?              http://www.mulix.org/cv.html