Process hollowing is commonly performed by creating a process in a suspended state then unmapping/hollowing its memory, which can then be replaced with malicious code.
You would not call ptrace-based process injection by that name for two reasons:
- You do not have to unmap memory prior to modifying it.
- You do not have to (and in fact cannot) start a process in a stopped state
On Linux, it is not necessary to start a process in a suspended state and unmap its memory in order to inject code into it. One can use ptrace(PTRACE_POKETEXT)
if they have the correct privileges after attaching to the tracee (which suspends its execution). There is no need to unmap anything.
The technique of process hollowing involves starting a process in a suspended state. While Windows has a flag in CreateProcess
which allows a process to be spawned in a suspended state, the Linux equivalent has not been supported since kernel 2.6.38. According to clone(2):
CLONE_STOPPED (since Linux 2.6.0)
If CLONE_STOPPED is set, then the child is initially
stopped (as though it was sent a SIGSTOP signal), and must
be resumed by sending it a SIGCONT signal.
This flag was deprecated from Linux 2.6.25 onward, and was
removed altogether in Linux 2.6.38. Since then, the
kernel silently ignores it without error. Starting with
Linux 4.6, the same bit was reused for the CLONE_NEWCGROUP
flag.
Because you don't have to "hollow out" the process prior to modifying its memory, and because you cannot start the process in a stopped state on Linux, the technique of ptrace-based process-injection would not be called process hollowing. Some people may still refer to it as process hollowing, though.