Add memfetch, a cool util to dump the memory of a process. Good debug tool.

PR:		ports/74371
Submitted by:	Yonatan <onatan@gmail.com>
This commit is contained in:
Pav Lucistnik 2004-11-27 21:26:55 +00:00
parent a71b91d3f7
commit 3bbf98e002
Notes: svn2git 2021-03-31 03:12:20 +00:00
svn path=/head/; revision=122619
8 changed files with 188 additions and 0 deletions

View file

@ -248,6 +248,7 @@
SUBDIR += manck
SUBDIR += mcron
SUBDIR += memdump
SUBDIR += memfetch
SUBDIR += memgrep
SUBDIR += memtest
SUBDIR += memtest86

View file

@ -0,0 +1,36 @@
# New ports collection makefile for: memfetch
# Date created: 25 Nov 2004
# Whom: Yonatan <onatan@gmail.com>
#
# $FreeBSD$
#
PORTNAME= memfetch
PORTVERSION= 0.05b
CATEGORIES= sysutils
MASTER_SITES= http://lcamtuf.coredump.cx/soft/
DISTNAME= ${PORTNAME}
EXTRACT_SUFX= .tgz
MAINTAINER= onatan@gmail.com
COMMENT= Utility to dump process memory
WRKSRC= ${WRKDIR}/${PORTNAME}
USE_PERL5_RUN= yes
USE_GETOPT_LONG=yes
CFLAGS+= ${CPPFLAGS}
MAKE_ENV+= LDFLAGS="${LDFLAGS}"
do-install:
${INSTALL_PROGRAM} ${WRKSRC}/${PORTNAME} ${PREFIX}/bin
${INSTALL_SCRIPT} ${WRKSRC}/mffind.pl ${PREFIX}/bin
.if !defined(NOPORTDOCS)
${MKDIR} ${DOCSDIR}
${INSTALL_DATA} ${WRKSRC}/README ${DOCSDIR}
.endif
post-install:
@${CAT} ${PKGMESSAGE}
.include <bsd.port.mk>

View file

@ -0,0 +1,2 @@
MD5 (memfetch.tgz) = cda6080b905436c11ec996e19c4a5563
SIZE (memfetch.tgz) = 12435

View file

@ -0,0 +1,13 @@
--- Makefile.orig Thu Nov 25 15:30:12 2004
+++ Makefile Thu Nov 25 15:31:32 2004
@@ -7,8 +7,8 @@
#
FILE = memfetch
-CFLAGS = -Wall -O9
-CC = gcc
+CFLAGS?= -Wall -O9
+CC ?= gcc
all: $(FILE)

View file

@ -0,0 +1,111 @@
--- memfetch.c.orig Mon Oct 20 20:04:45 2003
+++ memfetch.c Thu Nov 25 15:51:00 2004
@@ -20,6 +20,8 @@
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
+#include <sys/uio.h>
+#include <sys/types.h>
#include <sys/ptrace.h>
#include <fcntl.h>
#include <string.h>
@@ -27,7 +29,8 @@
#include <signal.h>
#include <time.h>
#include <sys/mman.h>
-#include <asm/page.h>
+/* #include <asm/page.h> */
+#include <sys/param.h>
#include <getopt.h>
#include <errno.h>
@@ -49,7 +52,7 @@
fprintf(outfile,"** Error message: " x); \
fclose(outfile); \
} \
- if (tracepid>0) ptrace(PTRACE_DETACH,tracepid,0,lastsig); \
+ if (tracepid>0) ptrace(PT_DETACH,tracepid,0,lastsig); \
exit(1); \
}
@@ -74,6 +77,7 @@
" -a - skip non-anonymous maps (libraries etc)\n"
" -w - write index file to stdout instead of mfetch.lst\n"
" -m - avoid mmap(), helps prevent hanging on some 2.2 boxes\n"
+ " - this is the only way to go on FreeBSD, for now.\n"
" -S xxx - dump segment containing address xxx (hex) only\n",myname);
exit(3);
}
@@ -124,7 +128,7 @@
if (kill(tracepid,0))
fatal("Process does not exist or is not accessible.\n");
- if (ptrace(PTRACE_ATTACH,tracepid,0,0))
+ if (ptrace(PT_ATTACH,tracepid,0,0))
fatal("Cannot attach to this process (already traced?).\n");
if ( wait(&st)<=0 || !WIFSTOPPED(st) ) {
@@ -149,7 +153,7 @@
while (1) {
- ptrace(PTRACE_CONT,tracepid,0,lastsig);
+ ptrace(PT_CONTINUE,tracepid,0,lastsig);
if (wait(&st)<=0) {
debug("[-] Process gone before receiving a fault signal.\n");
@@ -198,7 +202,7 @@
leavewait: // GOTOs for president!
- sprintf(tmp,"/proc/%d/maps",tracepid);
+ sprintf(tmp,"/proc/%d/map",tracepid);
mapfile=fopen(tmp,"r");
if (!mapfile) fatal("Cannot open %s for reading.\n",tmp);
@@ -237,8 +241,8 @@
int* writeptr;
char mapped=1;
- if (sscanf(tmp,"%x-%x",&st,&en)!=2) {
- debug("[!] Parse error in /proc/%d/maps (mockery?): %s",tracepid,tmp);
+ if (sscanf(tmp,"%x %x",&st,&en)!=2) {
+ debug("[!] Parse error in /proc/%d/map (mockery?): %s",tracepid,tmp);
continue;
}
@@ -280,7 +284,7 @@
st,len);
if (avoid_mmap) writeptr=MAP_FAILED; else {
- for (i=st;i<=en;i+=PAGE_SIZE) ptrace(PTRACE_PEEKDATA,tracepid,i,0);
+ for (i=st;i<=en;i+=PAGE_SIZE) ptrace(PT_READ_D,tracepid,(caddr_t)i,0);
writeptr=mmap(0,len,PROT_READ,MAP_PRIVATE,memfile,st);
}
@@ -292,7 +296,7 @@
if (lseek(memfile,st,SEEK_SET)!=st || read(memfile,writeptr,len)!=len) {
debug("[S] ");
for (i=0;i<len/4;i++)
- writeptr[i]=ptrace(PTRACE_PEEKDATA,tracepid,st+i*4,0);
+ writeptr[i]=ptrace(PT_READ_D,tracepid,(caddr_t)st+i*4,0);
} else debug("[N] ");
}
@@ -308,14 +312,14 @@
}
- if (!dumpcnt) fatal("No matching entries found in /proc/%d/maps.\n",tracepid);
+ if (!dumpcnt) fatal("No matching entries found in /proc/%d/map.\n",tracepid);
if (!textout) fprintf(outfile,"# End of file.\n");
debug("[*] Done (%d matching). Have a nice day.\n",dumpcnt);
fclose(outfile);
- ptrace(PTRACE_DETACH,tracepid,0,lastsig);
+ ptrace(PT_DETACH,tracepid,0,lastsig);
exit(0);

View file

@ -0,0 +1,16 @@
Memfetch is a very simple utility that can be used to dump process memory of
any userspace process running on the system without affecting its execution.
Why bother? Well, quite often it is desirable to see what code and what data
actually resides in memory under some pid (/proc entries are not always
accurate). Debuggers like gdb are pretty good for examining small sections
of code or memory, but are pretty much useless for massive comparison,
sophisticated searches and such. It's good to be able to retrieve full
memory image to run it thru grep, strings, your favorite viewer or any other
tool. Quite obviously, I developed this code not because it's extremely
difficult to do it on your own, but because it is a valuable shell utility
for all kinds of deep hacking activities that simply saves you time.
Memfetch is a convenient screenshot grabber for ssh or screen sessions, by
the way ;-)
WWW: http://lcamtuf.coredump.cx/

View file

@ -0,0 +1,5 @@
Security Warning:
This port requires that you mount procfs(5) filesystem in /proc.
Please note that this can pose a security risk.

View file

@ -0,0 +1,4 @@
bin/memfetch
bin/mffind.pl
%%PORTDOCS%%%%DOCSDIR%%/README
%%PORTDOCS%%@dirrm %%DOCSDIR%%