CODEWITHSUNDEEP
linuxubuntuptrace
XtrmJosh
XtrmJosh

Reputation: 939

Linux ptrace memory reading & process management

I'm trying to read a processes memory on Linux (Xubuntu, to be precise). I'm pretty new to Linux, though I've done this same read using Win32API ReadProcessMemory() before in Windows. The general idea is that I'm trying to develop some software for a game which will get my stats and upload them to a server, which will track my progress and keep a log of it. The end goal is to make a bot which will automatically play and farm data about the game. In order to do this, I need to be able to access the processes memory. In Windows, that's dead easy. In Linux, it's proving a little more complex.

I've found a memory address which contains information I want to read. The information is an int32, and it is stored at 84a1bd8. I found it using GameConqueror 0.13. The address remains correct after restarting, so it appears there is no ASLR (as there was in Windows). I also know the ProcessID (I can find this using task manager for now, though if someone knows a simple way to get a PID by either ClassName, Exe name, or similar, that would be great too!) So, that looks like it should be all I really need to use PTRACE_PEEKDATA to read the memory, right? Well, that's the problem, it doesn't appear to be. My code looks like this:

#include <iostream>
#include <string>
#include <sys/ptrace.h>
#include <errno.h>

using namespace std;

int main()
{
    pid_t pid = 4847;
    int addr = 0x84a1bd8;
    long ret = ptrace(PTRACE_TRACEME, pid, NULL, NULL);
    cout << "ptrace Status: " << ret << endl;
    cout << "Errno: " << errno << endl;
    ret = ptrace(PTRACE_PEEKDATA, pid, (void*)addr, NULL);
    cout << "ptrace Status: " << ret << endl;
    cout << "Errno: " << errno << endl;
    ret = ptrace(PTRACE_DETACH, pid, NULL, NULL);
    cout << "ptrace Status: " << ret << endl;
    cout << "Errno: " << errno << endl;
    return 0;
}

The output looks like this:

ptrace Status: 0
Errno: 0
ptrace Status: -1
Errno: 3
ptrace Status: -1
Errno: 3

Being quite new to Linux, I don't know where I'm to find error codes and how I can work out what this error actually means, and nor do I know if I am even declaring the address correctly. Should I declare it as an int in it's decimal equivalent? Is there anything I'm missing?

Thanks for your time

Upvotes: 2

Views: 4243

Answers (1)

XtrmJosh
XtrmJosh

Reputation: 939

Found the solution to be that when using ptrace() you must call in an order:

ptrace(PTRACE_ATTACH, pid, NULL, NULL)
ptrace(PTRACE_PEEKDATA, pid, addr, NULL)
ptrace(PTRACE_DETACH, pid, NULL, NULL)

So the simple answer: You need to attach and detach before and after reading the memory.

It may also be useful to know that between the attach and detach commands, the process will sleep, meaning this method isn't so good for my purpose, but may be useful to others :)

Thanks to @PeterL. for your help.

Upvotes: 3

Related Questions