3

On Linux (and maybe UNIX), you can access and even modify process's stack with things like ptrace, process_vm_ready, etc., but is there a way to access the copy of the binary that's being executed that is paged to memory? Not the executable itself, but the copy of it that is moved to memory for execution, never mind the intent behind doing so.

Thanks.

Improve this question

1 Answer 1

Reset to default
3

You can read the copy of the ELF (PT_LOAD) segments loaded in memory through process_vm_ready() and such. You can patch the read-only ELF segments using ptrace PTRACE_POKETEXT. This is used to insert breakpoints in the application code.

See for example Implementing breakpoints on x86 Linux.

This patches a private copy of the segment memory. This does not patch the original executable file.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .