| 19 | |
| 20 | |
| 21 | int ProcessView::readProcess(int pid) { |
| 22 | mPointerSize = 0; |
| 23 | mProcessModules.clear(); |
| 24 | char buffer[4096]; |
| 25 | snprintf(buffer, 64, "/proc/%d/exe", pid); |
| 26 | int fd = open(buffer, O_RDONLY | O_CLOEXEC); |
| 27 | if (fd < 0) { |
| 28 | return errno; |
| 29 | } |
| 30 | if (read(fd, buffer, 256) != 256) { |
| 31 | int err = errno; |
| 32 | close(fd); |
| 33 | return err; |
| 34 | } |
| 35 | close(fd); |
| 36 | if (buffer[0] == 0x7F && buffer[1] == 'E' && buffer[2] == 'L' && buffer[3] == 'F') { |
| 37 | char type = buffer[4]; |
| 38 | if (type == 1) { |
| 39 | mPointerSize = 4; |
| 40 | mArchitecture = reinterpret_cast<const Elf32_Ehdr *>(buffer)->e_machine; |
| 41 | } else if (type == 2) { |
| 42 | mPointerSize = 8; |
| 43 | mArchitecture = reinterpret_cast<const Elf64_Ehdr *>(buffer)->e_machine; |
| 44 | } else { |
| 45 | mPointerSize = 0; |
| 46 | mArchitecture = 0; |
| 47 | return EINVAL; |
| 48 | } |
| 49 | } else { |
| 50 | mPointerSize = 0; |
| 51 | mArchitecture = 0; |
| 52 | return EINVAL; |
| 53 | } |
| 54 | snprintf(buffer, 256, "/proc/%d/maps", pid); |
| 55 | // xHook Copyright (c) 2018-present, iQIYI, Inc. https://github.com/iqiyi/xHook |
| 56 | FILE *pf = fopen(buffer, "r"); |
| 57 | if (!pf) { |
| 58 | return errno; |
| 59 | } |
| 60 | char prot[5]; |
| 61 | char *path; |
| 62 | int pathname_pos = 0; |
| 63 | size_t pathname_len; |
| 64 | uint64_t address = 0; |
| 65 | uint64_t offset = 0; |
| 66 | while (fgets(buffer, sizeof(buffer), pf)) { |
| 67 | if (sscanf(buffer, "%" PRIx64 "-%*lx %4s %" PRIx64 " %*x:%*x %*ld%n", |
| 68 | &address, prot, &offset, &pathname_pos) != 3) { |
| 69 | continue; |
| 70 | } |
| 71 | // don't check 'r': Android 10 maps system library .text as executive only memory |
| 72 | if (prot[3] != 'p') { |
| 73 | // do not touch the shared memory |
| 74 | continue; |
| 75 | } |
| 76 | // check offset |
| 77 | // We are trying to find ELF header in memory. |
| 78 | // It can only be found at the beginning of a mapped memory regions |
no test coverage detected