source: neercs/trunk/src/grab.c @ 2504

/*
 *  neercs        console-based window manager
 *  Copyright (c) 2008 Pascal Terjan
 *                All Rights Reserved
 *
 *  $Id$
 *
 *  This program is free software. It comes without any warranty, to
 *  the extent permitted by applicable law. You can redistribute it
 *  and/or modify it under the terms of the Do What The Fuck You Want
 *  To Public License, Version 2, as published by Sam Hocevar. See
 *  http://sam.zoy.org/wtfpl/COPYING for more details.
 */

#include "config.h"

#include <errno.h>
#include <fcntl.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

#include "config.h"

#if defined USE_GRAB
#   include <sys/ioctl.h>
#   include <sys/ptrace.h>
#   include <sys/stat.h>
#   include <sys/syscall.h>
#   include <sys/user.h>
#   include <sys/wait.h>

#   include <linux/kdev_t.h>
#   include <linux/major.h>
#endif

#include "neercs.h"

#if defined __x86_64__
#   define RAX rax
#   define RBX rbx
#   define RCX rcx
#   define RDX rdx
#   define RSP rsp
#   define RIP rip
#else
#   define RAX eax
#   define RBX ebx
#   define RCX ecx
#   define RDX edx
#   define RSP esp
#   define RIP eip
#endif

#if defined USE_GRAB
static int memcpy_from_target(pid_t pid, void* dest, void* src, size_t n)
{
    unsigned int i;
    long *d, *s;
    d = (long*) dest;
    s = (long*) src;
    n /= sizeof(long);
    for(i = 0; i < n; i++)
    {
        d[i] = ptrace(PTRACE_PEEKTEXT, pid, s + i, 0);
        if(errno)
        {
            perror("ptrace(PTRACE_PEEKTEXT)");
            return -1;
        }
    }
    return 0;
}

static int memcpy_into_target(pid_t pid, void* dest, void* src, size_t n)
{
    unsigned int i;
    long *d, *s;
    d = (long*) dest;
    s = (long*) src;
    for(i = 0; i < n / sizeof(long); i++)
    {
        if(ptrace(PTRACE_POKETEXT, pid, d + i, s[i]) == -1)
        {
            perror("ptrace(PTRACE_POKETEXT)");
            return -1;
        }
    }
    return 0;
}

static int do_syscall(pid_t pid, struct user_regs_struct *regs)
{
    /* Method for remote syscall:
     *  - store current register status into oregs
     *  - move stack pointer to the next empty element
     *  - store current read stack contents into oinst
     *  - put CD 80 (int 0x80) into the stack
     *  - set instruction pointer to the current stack address
     *  - single step: execute instruction (int 0x80)
     *  - get new register values
     *  - restore old register values from oregs
     *  - restore old stack contents from oinst */
    struct user_regs_struct oregs;
    long oinst;

    if(ptrace(PTRACE_GETREGS, pid, NULL, &oregs) < 0)
    {
        fprintf(stderr, "PTRACE_GETREGS failed\n");
        return errno;
    }

    regs->RSP = oregs.RSP - sizeof(long);

    oinst = ptrace(PTRACE_PEEKTEXT, pid, regs->RSP, 0);
    if(errno)
    {
        fprintf(stderr, "PTRACE_PEEKTEXT failed\n");
        return errno;
    }

    if(ptrace(PTRACE_POKETEXT, pid, regs->RSP, (long)0x80cd) < 0) /* int 0x80 */
    {
        fprintf(stderr, "PTRACE_POKETEXT failed\n");
        return errno;
    }

    regs->RIP = regs->RSP;

    if(ptrace(PTRACE_SETREGS, pid, NULL, regs) < 0)
    {
        fprintf(stderr, "PTRACE_SETREGS failed\n");
        return errno;
    }

    if(ptrace(PTRACE_SINGLESTEP, pid, NULL, NULL) < 0)
    {
        fprintf(stderr, "PTRACE_SINGLESTEP failed\n");
        return errno;
    }
    waitpid(pid, NULL, 0);

    if(ptrace(PTRACE_GETREGS, pid, NULL, regs) < 0)
    {
        fprintf(stderr, "PTRACE_GETREGS failed\n");
        return errno;
    }

    if(ptrace(PTRACE_SETREGS, pid, NULL, &oregs) < 0)
    {
        fprintf(stderr, "PTRACE_SETREGS failed\n");
        return errno;
    }

    if(ptrace(PTRACE_POKETEXT, pid, oregs.RSP - sizeof(long), oinst) < 0)
    {
        fprintf(stderr, "PTRACE_POKETEXT failed\n");
        return errno;
    }

    return 0;
}

static int do_close(pid_t pid, int fd)
{
    struct user_regs_struct regs;
    if(ptrace(PTRACE_GETREGS, pid, NULL, &regs) < 0)
    {
        fprintf(stderr, "PTRACE_GETREGS failed\n");
        return errno;
    }

    regs.RAX = SYS_close;
    regs.RBX = fd;

    return do_syscall(pid, &regs);
}

static int do_dup2(pid_t pid, int oldfd, int newfd)
{
    struct user_regs_struct regs;
    if(ptrace(PTRACE_GETREGS, pid, NULL, &regs) < 0)
    {
        fprintf(stderr, "PTRACE_GETREGS failed\n");
        return errno;
    }

    regs.RAX = SYS_dup2;
    regs.RBX = oldfd;
    regs.RCX = newfd;

    return do_syscall(pid, &regs);
}

static int do_open(pid_t pid, char *path, int mode, int *fd)
{
    struct user_regs_struct regs;
    void *backup_page;
    void *target_page = (void*)(0x08048000);
    size_t size = (1 << 12); /* 4K */
    int ret;

    /* Backup the page that we will use */
    backup_page = malloc(size);
    if(memcpy_from_target(pid, backup_page, target_page, size) < 0)
        return -1;

    if(ptrace(PTRACE_GETREGS, pid, NULL, &regs) < 0)
    {
        fprintf(stderr, "PTRACE_GETREGS failed\n");
        return errno;
    }

    /* +4 (or 8) because it's truncated on a multiple of 4 (or 8)
     * and we need 1 */
    memcpy_into_target(pid, target_page, path, strlen(path) + sizeof(long));

    regs.RAX = SYS_open;
    regs.RBX = (long)target_page;
    regs.RCX = O_RDWR;
    regs.RDX = 0755;

    if((ret = do_syscall(pid, &regs)) != 0)
    {
        return ret;
    }

    /* Restore the pages */
    memcpy_into_target(pid, target_page, backup_page, size);

    *fd  = regs.RAX;

    return 0;
}

static int do_setsid(pid_t pid)
{
    struct user_regs_struct regs;
    int ret;

    if(ptrace(PTRACE_GETREGS, pid, NULL, &regs) < 0)
    {
        fprintf(stderr, "PTRACE_GETREGS failed\n");
        return errno;
    }

    debug("Running setsid on process %d (sid=%d)", pid, getsid(pid));

    regs.RAX = SYS_setpgid;
    regs.RBX = 0;
    regs.RCX = getsid(pid);

    if((ret = do_syscall(pid, &regs)) != 0)
    {
        fprintf(stderr, "syscall setpgid failed\n");
        return ret;
    }

    if(regs.RAX != 0)
    {
        fprintf(stderr, "setpgid returned %ld\n", (long)regs.RAX);
        return -regs.RAX;
    }

    regs.RAX = SYS_setsid;

    if((ret = do_syscall(pid, &regs)) != 0)
    {
        fprintf(stderr, "syscall setsid failed\n");
        return ret;
    }

    debug("pid %d has now sid %d", pid, getsid(pid));

    if((long int)regs.RAX == -1L)
    {
        fprintf(stderr, "getsid failed\n");
        return -regs.RAX;
    }

    return 0;
}
#endif

int grab_process(pid_t pid, char *ptyname, int ptyfd)
{
#if defined USE_GRAB
    int i, fd = 0, mode, ret;
    char fdstr[1024];
    char to_open[3];
    struct stat stat_buf;

    debug("pty is %s", ptyname);

    kill(pid, SIGSTOP);
    if(ptrace(PTRACE_ATTACH, pid, 0, 0) < 0)
    {
        fprintf(stderr, "Cannot access process %d\n", pid);
        return errno;
    }
    kill(pid, SIGCONT);
    waitpid(pid, NULL, 0);

    for(i = 0; i <= 2; i++)
    {
        snprintf(fdstr, sizeof(fdstr), "/proc/%d/fd/%d", pid, i);
        to_open[i]=0;
        lstat(fdstr, &stat_buf);
        if((stat_buf.st_mode & S_IRUSR) && (stat_buf.st_mode & S_IWUSR))
            mode = O_RDWR;
        else if(stat_buf.st_mode & S_IWUSR)
            mode = O_WRONLY;
        else
            mode = O_RDONLY;

        if(stat(fdstr, &stat_buf) < 0)
            continue;

        if(!S_ISCHR(stat_buf.st_mode) || MAJOR(stat_buf.st_rdev) != UNIX98_PTY_SLAVE_MAJOR)
            continue;

        debug("fd %d is a pty", i);
        if((ret = do_close(pid, i)))
        {
            fprintf(stderr, "do_close %s\n", strerror(ret));
        }
        to_open[i]=1;
    }

    if((ret = do_setsid(pid)))
    {
        fprintf(stderr, "do_setsid %s\n", strerror(ret));
    }

    for(i = 0; i <= 2; i++)
    {
        if(!to_open[i])
            continue;
        if((ret = do_open(pid, ptyname, mode, &fd)))
        {
            fprintf(stderr, "do_open %s\n", strerror(ret));
        }
        if((ret = do_dup2(pid, fd, i)))
        {
            fprintf(stderr, "do_dup2 %s\n", strerror(ret));
        }
    }

    kill(pid, SIGWINCH);
    ptrace(PTRACE_DETACH, pid, 0, 0);

    return 0;
#else
    return -1;
#endif
}