reptyr

, but that had other issues (I don't remember). The solution I ended up was to implement a fork server. Some server proc starts initially and only preloads the modules and maybe other things, and then waits. Once I want to execute some script, I can fork from the server and use this forked process right away. I used similar logic as in reptyr (https://github.com/nelhage/reptyr) to redirect the PTY. This worked quite well. https://github.com/albertz/python-preloaded

k troubles, and network disconnects is usually where I get my SIGHUP. i don't like screen very much, even though i do continue to use it (owing more to its ubiquity and utility); it's full of all kinds of questionable ui decisions, and so many features i use so infrequently i need to constantly be re-reading the manual. i think if you have learned it and liked it okay, but all i ever want is terminal mobility, and i get a much nicer experience out of two tools: - mosh: https://mosh.org/ - reptyr: https://github.com/nelhage/reptyr using mosh means i don't get SIGHUP, and if i lose my local display, i can open another mosh, reptr my old session (it's still there!) and keep on hacking.

o be able to change the instruction pointer of the process and coax it into calling dlopen(). The functionality available to you is: - You can use ptrace to stop the process, read and write the saved registers, read and write its memory, resume the process, or resume the process until the next instruction (single step) or next syscall. It's the API used by debuggers. If you run `print dlopen("file.so")` from GDB, this is exactly what GDB will do: it'll use ptrace to make up a stack frame to call dlopen with the arguments you specify and then hit a breakpoint, and GDB will print the result. Another good example of using this to inject code for non-malicious purposes is https://github.com/nelhage/reptyr , which lets you tell another process to switch terminals (e.g., move it into a screen/tmux session). - You can use /proc/$pid/mem or the process_vm_writev syscall to modify the stack but not the instruction pointer, because the stack is in memory. That puts you effectively in the same position as an exploit writer: you have to create a stack frame that returns to custom code somehow, or uses return-oriented programming to call the function you want to call. Then when the program returns from its current stack frame, it'll call your shellcode or ROP gadget. - You can use /proc/$pid/mem or the process_vm_writev syscall to modify the code at the instruction pointer, even though you can't modify the instruction pointer itself. That's what this program does - it backs up a segment of instructions about to be executed, overwrites it with shellcode, and restores the instructions once the shellcode is done. ptrace, /proc/$pid/mem, and process_vm_readv/writev have permission checks. On most systems, you have to be running as the same user as the program you're trying to mess with. On systems including the "Yama" Linux security module - notably including Ubuntu - you also have to be an ancestor process of the process you're trying to attach to, which is a security measure intended to make it harder for malware to steal secrets out of other programs you're running, without preventing debuggers etc. from working. See https://www.kernel.org/doc/Documentation/security/Yama.txt for details. (Again, this is the same interface as a debugger uses. If you're not prevented from debugging your own programs, yes, you can inject malicious code into them without limitation - and it's generally easier to use a debugger than to write your own custom injector to do it.)