我正在尝试将程序从 Windows 移植到 Linux。
当我发现没有“真实”的时候,我遇到了一个问题ReadProcessMemory
Linux 上的对应项;我寻找替代方案,然后发现ptrace
,一个强大的进程调试器。
我快速用 C++ 编写了两个小型控制台应用程序来测试ptrace
,然后在程序中使用它。
TestApp
这是tracee;它每 50 毫秒打印两个整数,同时每次将它们的值加 1。
#include <QCoreApplication>
#include <QThread>
#include <iostream>
using namespace std;
class Sleeper : public QThread
{
public:
static void usleep(unsigned long usecs){QThread::usleep(usecs);}
static void msleep(unsigned long msecs){QThread::msleep(msecs);}
static void sleep(unsigned long secs){QThread::sleep(secs);}
};
int main(int argc, char *argv[])
{
QCoreApplication a(argc, argv);
int value = 145;
int i = 0;
do {
cout << "i: " << i << " " << "Value: " << value << endl;
value++;
i++;
Sleeper::msleep(50);
} while (true);
return a.exec();
}
记忆测试
这是追踪器;它询问进程名称并使用命令检索 PIDpidof -s
, then ptrace
附加到进程并每 500 毫秒检索一次内存地址的值,共 10 次。
#include <QCoreApplication>
#include <QThread>
#include <iostream>
#include <string>
#include <sys/ptrace.h>
#include <errno.h>
using namespace std;
class Sleeper : public QThread
{
public:
static void usleep(unsigned long usecs){QThread::usleep(usecs);}
static void msleep(unsigned long msecs){QThread::msleep(msecs);}
static void sleep(unsigned long secs){QThread::sleep(secs);}
};
int main(int argc, char *argv[])
{
QCoreApplication a(argc, argv);
char process_name[50];
cout << "Process name: ";
cin >> process_name;
char command[sizeof(process_name) + sizeof("pidof -s ")];
snprintf(command, sizeof(command), "pidof -s %s", process_name);
FILE* shell = popen(command, "r");
char pidI[sizeof(shell)];
fgets(pidI, sizeof(pidI), shell);
pclose(shell);
pid_t pid = atoi(pidI);
cout << "The PID is " << pid << endl;
long status = ptrace(PTRACE_ATTACH, pid, NULL, NULL);
cout << "Status: " << status << endl;
cout << "Error: " << errno << endl;
unsigned long addr = 0x012345; // Example address, not the true one
int i = 0;
do {
status = ptrace(PTRACE_PEEKDATA, pid, addr, NULL);
cout << "Status: " << status << endl;
cout << "Error: " << errno << endl;
i++;
Sleeper::msleep(500);
} while (i < 10);
status = ptrace(PTRACE_DETACH, pid, NULL, NULL);
cout << "Status: " << status << endl;
cout << "Error: " << errno << endl;
return a.exec();
}
一切正常,但 TestApp 被暂停 (SIGSTOP) 直到ptrace
脱离它。
另外,当它附加到进程时,状态为0,错误为2;第一次尝试检索内存地址值时失败,状态为 -1,错误为 3。这正常吗?
有没有办法阻止 ptrace 向进程发送 SIGSTOP 信号?
我已经尝试过使用PTRACE_SEIZE
代替PTRACE_ATTACH
,但它不起作用:状态 -1 和错误 3。
Update: Using Sleeper
在MemoryTest中的“do-while”循环之前修复了第一个内存地址值检索的问题,即使秒、毫秒或微秒的值是0。为什么?