[feature] Injecting from buffer

[enty8080]

Hi, @kubo

May I ask you if it is possible to inject a shared object library from buffer instead of from the disk. It might be useful when you don't have access to the file system. Moreover, it would be useful if you don't want to write object to disk in order to inject it.

Is it hard to achieve? How can it be done?

Thanks in advance,
Ivan Nikolskiy (@enty8080)

[neonbyte1]

@enty8080 why should the executing person not have access to the file system? Without ptrace capabilities or without executing it as root, a library cannot be injected anyway.

Anyways, re-writing the injector to act like a manual mapper is not an easy task. But you can simply add a method to call memfd_create remotely.

int injector_create_shared_memory(
    const injector_t* injector,
    const void*       data,
    const size_t      size,
    const char*       shm_name,
    int*              shm_fd
)
{
    intptr_t fd = 0;
    int      rv = data != NULL && size > 0
        ? INJERR_SUCCESS
        : INJERR_FILE_NOT_FOUND;

    if (rv == INJERR_SUCCESS) {
        rv = injector__write(
            injector,
            injector->data,
            shm_name,
            strlen(shm_name)
        );
    }
    if (rv == INJERR_SUCCESS) {
        // memfd_create(shm_name, 1);
        rv = injector__call_syscall(injector, &fd, 319, injector->data, 1) == 0
            ? INJERR_SUCCESS
            : INJERR_ERROR_IN_TARGET;
    }
    if (rv == INJERR_SUCCESS) {
        // injector->data_size is 4096, we're using 2KB just to be safe
        int chunk_id = 0;

        for (size_t offset = 0; offset < size; ++chunk_id) {
            const size_t chunk_size = INJECTOR_MIN(size - offset, 2048);

            rv = injector__write(
                injector,
                injector->data,
                data + offset,
                chunk_size
            );

            if (rv != INJERR_SUCCESS) {
                break;
            }

            // pwrite64((int)fd, data + offset, chunk_size, offset);
            rv = injector__call_syscall(
                injector,
                NULL,
                18 /*pwrite64*/,
                fd,
                injector->data,
                chunk_size,
                offset
            ) == 0 ? INJERR_SUCCESS : INJERR_ERROR_IN_TARGET;

            if (rv != INJERR_SUCCESS) {
                break;
            }

            offset += chunk_size;
        }
    }
    if (rv == INJERR_SUCCESS && shm_fd) {
        *shm_fd = (int)fd;
    }

    return rv;
}

So you basically pass the pointer to your ELF image and the raw file size into data and size arguments and you'll receive the shared memory file descriptor via shm_fd. Use it to map the image from memory. You just map /proc/<pid>/fd/shm_fd as your path instead of the path to your filesystem.

Don't forget to destroy the shared memory afterwards.

int injector_destroy_shared_memory(const injector_t* injector, const int shm_fd)
{
    return injector__call_syscall(injector, NULL, 3, shm_fd) == 0
        ? INJERR_SUCCESS
        : INJERR_ERROR_IN_TARGET;
}

I've done this in the past and it might not be the best solution, but it's a solution. Or understand how the linux kernel loads ELF images and rebuild it.

[kubo]

Thank you for reporting this issue.
Unfortunately, due to a shift in my personal interests, this project is now archived.
Consequently, I have closed all open issues and pull requests.

If you're looking for a successor project, please check the network graph to see if any forks have continued development.