accessing argv on exec

13 Nov 2014

      I'm used to thinking that ps reads from a process's private memory in
order to get the command arguments.  Using the code below, I think
that I have proved that this is false on OSX 10.6.8.  That suggest
that ps -f is reading from somewhere in the kernel.  Would that be
easy to walk down?

Regards,
James.

================
#include <stdio.h>
#include <signal.h>

int main(int argc, char *argv[])
  /* hack every other argument into a pointer into unreadable low memory,
   * then sigstop myself */
{
  int i;

  for (i = argc; --i;)
    if (i%2)
      argv[i] = (char *)i;

  printf("Stopping ...\n");
  kill(getpid(), SIGSTOP);

  return 0;
}
================
$ make
cc -g  -g  hackArgv.c   -o hackArgv
hackArgv.c: In function ‘main’:
hackArgv.c:12: warning: cast to pointer from integer of different size
$ ./hackArgv this that the other etc
Stopping ...

[1]+  Stopped                 ./hackArgv this that the other etc
$ ps | fgrep hackArgv
82712 ttys002    0:00.00 ./hackArgv this that the other etc
82716 ttys002    0:00.00 fgrep hackArgv
$ fg
./hackArgv this that the other etc
$
=======================
On 11/13/14, darwin-kernel-request@lists.apple.com
<darwin-kernel-request@lists.apple.com> wrote:
<snip> Message: 7
...
Date: Wed, 12 Nov 2014 10:45:41 -0800
From: Peter Moody <pmoody@google.com>
To: "Manu ." <gnork99@hotmail.com>
Cc: darwin-kernel@lists.apple.com, markg@garetech.com.au
Subject: Re: accessing argv on exec
Message-ID: <r3nlhng1cmi.fsf@perdido.sfo.corp.google.com>
Content-Type: text/plain
On Tue, Nov 11 2014 at 22:52, Manu . wrote:
...
You may also want to look at task_info. While it only gives you the all
loaded images list, there is some code that
you can find which can use task_info or get the offset of the structure in
memory. There is a gContext variable in
dyld that contains argv[] so if one can retrieve the loaded modules
structure address, it should be possible to get
the rest. Kind of wish that the arguments would be kept in the proc_t and
made available (like on Windows EPROCESS
-> PEB -> command line), alas it's not the case.
Hey Manu,
I'm probably missing something super obvious, but task_info() doesn't
appear to be resolvable from a kext. Were you suggesting doing this from
userspace?
...
Date: Tue, 11 Nov 2014 16:25:46 -0800
Subject: Re: accessing argv on exec
From: meklort@gmail.com
To: pmoody@google.com
CC: darwin-kernel@lists.apple.com; markg@garetech.com.au
...
Hi Peter,Here's some simple code form the days of 10.6. I expect it should
still work with minor tweaks (and
commenting the printfs).
This is awesome! Thanks, Evan.
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Darwin-kernel mailing list      (Darwin-kernel@lists.apple.com)
Help/Unsubscribe/Update your Subscription:
https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists....

This email sent to site_archiver@lists.apple.com

James C

tags

participants (1)