Read the stack of another process?

Question

I'm trying to read a child process's stack but with no luck. I know it is possible using ptrace, but ptrace's interface allows you to read only one word at a time, and I'm trying to scan a larger portions of the stack.

I've also tried reading the /proc/$pid/mem from the boundries of the stack as extracted from the /proc/$pid/maps file after first using ptrace to attach to it (as suggested here) but the read keeps failing (even when running as root) although the same code succeeds when tried reading from different parts of the process (e.g. heap).

What am I doing wrong? Is there any other option?

Answer 1

ptrace's interface allows you to read only one word at a time, and I'm trying to scan a larger portions of the stack

Well, just use a loop, then. I honestly don't see how that constitutes a problem with ptrace, I use it all the time to remotely access processes.

I use something like this:

static int memcpy_from_target(pid_t pid, char *dest, long src, size_t n)
{
    static int const align = sizeof(long) - 1;
while (n)
{
    size_t todo = MIN(n, sizeof(long) - (src & align));
    long data = ptrace(PTRACE_PEEKTEXT, pid, src - (src & align), 0);
    if (errno)
    {
        perror("ptrace_peektext (memcpy_from_target)");
        return -1;
    }
    memcpy(dest, (char *)&data + (src & align), todo);

    dest += todo; src += todo; n -= todo;
}

return 0;

}

Answer 2

Another suggestion.

When/if it gets accepted in the main Linux kernel tree, you will be able to use Christopher Yeoh's Cross Memory Attach patch. See the documentation for process_vm_readv for instance.

Answer 3

You can easily read the stack of another process using the proc file system (You will need root access for this). Before arbitrarily reading from the /proc/pid/mem you need to consult the /proc/pid/maps. A simple read in this file shows a lot of entries. We are interested in the entry marked as stack. Once you get this you need to read the lower and upper bounds of the stack. Now simply open the /proc/pid/mem file, seek to the lower bound of the stack and read the correct size of data.

Answer 4

Here is another strategy that might need tweaking but should be more efficient with large chunks of data. The idea is to execute syscalls in the remote process in order to retrieve the stack contents. It will need specific architecture code but if you only target x86 / x86_64 it shouldn't be too much hassle.

1. Create a named pipe such as "/tmp/fifo" in your calling process.
2. Step into the traced process until it returns from a syscall, using PTRACE_SYSCALL to step, waitpid() to wait and PTRACE_GETREGS/PTRACE_PEEKTEXT to check the currently executed opcode.
3. Backup the remote process’s registers and a small area of its stack.
4. Execute syscalls on the remote process by overriding its stack with your own data: open("/tmp/fifo"), write() the stack contents, close() the descriptor.
5. Restore the remote process’s state.
6. Read the fifo data from your calling process.

There might be more elegant alternatives to the named pipe, but I can’t think of any right now. The reason I only use syscalls is because remote code injection is pretty unreliable on modern systems due to various security protections. The drawback is that it will hang until the remote process does a syscall (which can be a problem for some programs that mostly do computations).

You can see some free code implementing most of the work in this source file. Feedback on the code is welcome!

Answer 5

You could try lsstack. It uses ptrace, just like every other successful "read another process's stack" program. I could not get a program using /proc/$pid/mem reading to work. I believe that you can't do it that way, although, logically, you should.