在最新的 Linux 上执行进程堆栈中的代码
我想使用 ptrace 在正在运行的进程的堆栈中编写一段二进制代码。 然而，这会导致分段错误（信号 11）。
我可以确保 %eip 寄存器存储指向我想要在堆栈中执行的第一条指令的指针。我猜linux有某种机制保护堆栈数据可执行。
那么，有谁知道如何禁用堆栈的这种保护。具体来说，我正在尝试 Fedora 15。
非常感谢！
阅读完所有回复后，我尝试了 execstack，它确实使堆栈中的代码可执行。谢谢大家！
I want to use ptrace to write a piece of binary code in a running process's stack.
However, this causes segmentation fault (signal 11).
I can make sure the %eip register stores the pointer to the first instruction that I want to execute in the stack. I guess there is some mechanism that linux protects the stack data to be executable.
So, does anyone know how to disable such protection for stack. Specifically, I'm trying Fedora 15.
Thanks a lot!
After reading all replies, I tried execstack, which really makes code in stack executable. Thank you all!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
这可能是由于现代处理器上的 NX 位所致。您可以使用 execstack 为您的程序禁用此功能。
http://advosys.ca/viewpoints/ 2009/07/disabling-the-nx-bit-for-specific-apps/
http://linux.die.net/man/8/execstack
This is probably due to the NX bit on modern processors. You may be able to disable this for your program using
execstack.http://advosys.ca/viewpoints/2009/07/disabling-the-nx-bit-for-specific-apps/
http://linux.die.net/man/8/execstack
正如已经提到的，这是由于 NX 位造成的。但这是可能的。我确信 gcc 将它本身用于蹦床（这是一种制作嵌套函数的函数指针的解决方法）。我没有查看详细信息，但我建议您查看 gcc 代码。在源代码中搜索特定于体系结构的宏
TARGET_ASM_TRAMPOLINE_TEMPLATE，您应该可以看到它们是如何实现的。编辑：快速谷歌搜索该宏，给了我提示：
mprotect用于更改内存页面的权限。当您生成日期并执行它时也要小心 - 除了刷新指令缓存之外，您可能还需要小心。As already mentioned it is due to the NX bit. But it is possible. I know for sure that gcc uses it itself for trampolines (which are a workaround to make e.g. function pointers of nested functions). I dont looked at the detailes, but I would recommend a look at the gcc code. Search in the sources for the architecture specific macro
TARGET_ASM_TRAMPOLINE_TEMPLATE, there you should see how they do it.EDIT: A quick google for that macro, gave me the hint:
mprotectis used to change the permissions of the memory page. Also be carefull when you generate date and execute it - you maybe have in addition to flush the instruction cache.