Changes

=== Running the parasite ===

=== Running the parasite ===

Injection of a parasite code may be spitted into two phases

Injection of a parasite code may be splitted into two phases

# preparation of a victim task

# preparation of a victim task

# injection itself

# injection itself

During preparation stage we move a victim into that named ''seized'' state with help of '''prctl''' system call (in this state the victim does not recognize that it is being manipulated by someone). Once seized we substitute current CS:IP code with '''mmap''' system call allocating shared memory space needed to carry parasite blob.

During preparation stage we move a victim into that named ''seized'' state with help of '''prctl''' system call (in this state the victim does not recognize that it is being manipulated by someone). Once seized we substitute current code at '''IP''' (instruction pointer) with '''mmap''' system call allocating a shared memory space needed to carry a parasite blob.

Parasite code injection is simple: because we have a shared memory slab allocated inside victim space we can scan <code>/proc/$pid/map_files/</code> directory and open this slab inside CRIU address space. Once opened we simply copy parasite code there with '''memcpy'''.

Parasite code injection itself is pretty simple: because we have a shared memory slab allocated inside a victim space we can scan <code>/proc/$pid/map_files/</code> directory and open this slab inside CRIU address space. Once opened we simply copy parasite code there with '''memcpy'''.

At this moment we can run parasite code adjusting CS:IP of the victim and call '''prctl''' again. After that parasite is spinning listening the socket for commands from outside world.

At this moment we can run parasite code adjusting '''IP''' of the victim and call '''prctl''' again. After that parasite is spinning listening the socket for commands from outside world.

=== Parasite internal structure ===

=== Parasite internal structure ===