diff options
| -rw-r--r-- | README.md | 38 | ||||
| -rw-r--r-- | hypodermic/main.py | 6 | ||||
| -rw-r--r-- | hypodermic/process.py (renamed from hypodermic/ptrace.py) | 7 |
3 files changed, 26 insertions, 25 deletions
@@ -14,11 +14,14 @@ redirected. There have been a few attempts at this in the past, such as This is oftentimes unsuccessful, being very dependent upon how glibc was compiled. -The goal of Hypodermic is to find a means of injecting a dynamic library into -any Linux executable, even ones that are statically-linked, and tranferring this -method over to [PINCE][2] when it is stable enough. +The point of Hypodermic is to find a means of injecting a dynamic library into +any Linux executable, even ones that are statically-linked, and transferring +this method over to [PINCE][2] when it is stable enough. The current goal is the +ability to inject an internal cheat into Counter-Strike: Global Offensive, such +as [AimTux][3]. This will signal that the method has reached a point of +viability. -Hypodermic is free software, licensed under the [GNU General Public License.][3] +Hypodermic is free software, licensed under the [GNU General Public License.][4] ## Current Attempts @@ -37,20 +40,21 @@ stack in an attempt to trick the RTLD. ## Important Resources -* [Understanding Linux ELF RTLD internals][4] -* [Runtime Process Infection][5] -* [ELF Program Header][6] -* [Dynamic Loader Operation][7] -* [About ELF Auxiliary Vectors][8] -* [Code Injection into Running Linux Application][9] +* [Understanding Linux ELF RTLD internals][5] +* [Runtime Process Infection][6] +* [ELF Program Header][7] +* [Dynamic Loader Operation][8] +* [About ELF Auxiliary Vectors][9] +* [Code Injection into Running Linux Application][10] [1]: https://github.com/gaffe23/linux-inject [2]: https://github.com/korcankaraokcu/PINCE -[3]: https://www.gnu.org/licenses/gpl.html -[4]: http://s.eresi-project.org/inc/articles/elf-rtld.txt -[5]: http://phrack.org/issues/59/8.html -[6]: http://www.sco.com/developers/gabi/latest/ch5.pheader.html -[7]: https://sourceware.org/glibc/wiki/DynamicLoader -[8]: http://articles.manugarg.com/aboutelfauxiliaryvectors -[9]: https://www.codeproject.com/Articles/33340/Code-Injection-into-Running-Linux-Application +[3]: https://github.com/AimTuxOfficial/AimTux/ +[4]: https://www.gnu.org/licenses/gpl.html +[5]: http://s.eresi-project.org/inc/articles/elf-rtld.txt +[6]: http://phrack.org/issues/59/8.html +[7]: http://www.sco.com/developers/gabi/latest/ch5.pheader.html +[8]: https://sourceware.org/glibc/wiki/DynamicLoader +[9]: http://articles.manugarg.com/aboutelfauxiliaryvectors +[10]: https://www.codeproject.com/Articles/33340/Code-Injection-into-Running-Linux-Application diff --git a/hypodermic/main.py b/hypodermic/main.py index 635e3a7..74c4486 100644 --- a/hypodermic/main.py +++ b/hypodermic/main.py @@ -21,7 +21,7 @@ import argparse import sys import textwrap -from hypodermic.ptrace import Process +from hypodermic.process import Process class CustomHelp(argparse.HelpFormatter): @@ -106,8 +106,8 @@ def main(): sys.exit(1) if args.create: - alert("Creating process at path {}".format(args.create)) + alert("Creating process at path '{}'...".format(args.create)) p = Process(path=args.create) else: - alert("Attaching to process with pid {}".format(args.attach)) + alert("Attaching to process with pid {}...".format(args.attach)) p = Process(pid=args.attach) diff --git a/hypodermic/ptrace.py b/hypodermic/process.py index 714b567..6fc1519 100644 --- a/hypodermic/ptrace.py +++ b/hypodermic/process.py @@ -112,12 +112,9 @@ class Process(object): """ return maps(self.pid) - # FIXME: This approach does not work outside of seeing if the - # process has an RTLD page. The reality is that the RTLD is - # broken up into independent several pages. @property def rtld(self) -> Region: - """Obtain the region of memory for the process' RTLD, if it + """Obtain the base region of memory for the process' RTLD, if it exists. Returns: @@ -125,5 +122,5 @@ class Process(object): RTLD was found. """ for region in self.maps: - if re.search(r"ld.+\.so", region.path): + if re.search(r"ld.+\.so", region.path) and region.off == 0: return region |