Is it wrong to refer to ptrace process injection as process hollowing

Question

ATT&CK defines process injection sub-technique 012 Process Hollowing different from sub-technique 008 Ptrace system calls.

With this in mind, if I write some fancy shellcode into the .text segment in a suspended process, which, unless I'm wrong, is considered process hollowing on Windows, on Linux using ptrace, is it wrong to refer to it as process hollowing?

Answer 1

Process hollowing is commonly performed by creating a process in a suspended state then unmapping/hollowing its memory, which can then be replaced with malicious code.

You would not call ptrace-based process injection by that name for two reasons:

1. You do not have to unmap memory prior to modifying it.
2. You do not have to (and in fact cannot) start a process in a stopped state

On Linux, it is not necessary to start a process in a suspended state and unmap its memory in order to inject code into it. One can use ptrace(PTRACE_POKETEXT) if they have the correct privileges after attaching to the tracee (which suspends its execution). There is no need to unmap anything.

The technique of process hollowing involves starting a process in a suspended state. While Windows has a flag in CreateProcess which allows a process to be spawned in a suspended state, the Linux equivalent has not been supported since kernel 2.6.38. According to clone(2):

   CLONE_STOPPED (since Linux 2.6.0)
          If CLONE_STOPPED is set, then the child is initially
          stopped (as though it was sent a SIGSTOP signal), and must
          be resumed by sending it a SIGCONT signal.

          This flag was deprecated from Linux 2.6.25 onward, and was
          removed altogether in Linux 2.6.38.  Since then, the
          kernel silently ignores it without error.  Starting with
          Linux 4.6, the same bit was reused for the CLONE_NEWCGROUP
          flag.

---

Because you don't have to "hollow out" the process prior to modifying its memory, and because you cannot start the process in a stopped state on Linux, the technique of ptrace-based process-injection would not be called process hollowing. Some people may still refer to it as process hollowing, though.