Arbitrary "files" in /proc/?

Asked Sep 22 '19 at 11:21

Active Sep 22 '19 at 11:44

Viewed 48 times

Is there a way to create files in /proc/ without actually writing a kernel module?

This is for reverse engineering purposes, an app expects certain things in /proc/ and I do not want to write a kernel module to supply it. The app simply just reads /proc/something/some_key and expects certain/known values.

EDIT: Union mount doesn't seem to work as I need a new directory, e.g. /proc/new_dir/ and some files in there and making union on top of /proc/ itself seems to break it.

edited Sep 22 '19 at 11:44

asked Sep 22 '19 at 11:21

lukash

Did you check if it is possible to mount an overlay on top of /proc? – Tomáš Pospíšek Sep 22 '19 at 11:32
Then don't mount procfs or any API filesystem on it – 炸鱼薯条德里克 Sep 22 '19 at 11:40
You can use LD_PRELOAD and a small C program to override open. https://unix.stackexchange.com/a/237681/49439 – Mark Plotnick Sep 22 '19 at 16:05
@MarkPlotnick I tried but it uses openat to open /proc/something/some_key and LD_PRELOAD cannot catch that, I assume that is not dynamically linked to use openat – lukash Sep 22 '19 at 22:17

Arbitrary "files" in /proc/?

0 Answers0