2,257
edits
Changes
Jump to navigation
Jump to search
Created page describing 'exec' command.
This page describes how the <code>exec</code> command in crtools works.
== Description ==
The <code>exec</code> command executes arbitrary system call from another task's context. It does so by exploiting the parasite code execution feature, which is also used to dump various process' information.
== Syntax ==
The command syntax is
<pre>
crtools exec -t <pid> <syscall-name> <syscall-arguments>
</pre>
The <code>syscall-name</code> is just a name of a system call. Since typically each syscall is wrapped with the respective glibc function, you can find out information about the interesting system call in the respective man page.
The rest of the command line is treated as <code>syscall-arguments</code>. Each command line argument in this list is converted into the system call argument by the following rules:
* If an argument starts with '&', the rest of it is copied to the target task's address space (it's allocated by remotely calling the <code>mmap</code> syscall) and the pointer to this area is passed as the system call argument
* Otherwise, the argument is converted into an <code>unsigned long</code> number with <code>strtol</code> and passed to system call directly
* Not specified arguments (if required by system call) are set to 0
In order to execute a system call for remote task, you don't have to be root -- you should only have rights to do debugging (strace) on it.
If you want to make task perform some action, that consists of several syscalls, you should first stop it with <code>SIG_STOP</code>.
== Examples ==
=== Re-opening stdout ===
You can close the 1st fd from a task and re-open it into some other file like this
<pre>
# crtools exec -t <pid> close 1
# crtools exec -t <pid> open '&<path-to-file>' 2
</pre>
In the 2nd string 2 means the <code>O_RDWR</code> opening mode.
=== Adding madvise-s to a mapping ===
You can tune the task's address space with <code>madvise</code> bits like this
<pre>
# crtools exec -t <pid> madvise <start> <lenght> <madvise-bits-value>
</pre>
== Description ==
The <code>exec</code> command executes arbitrary system call from another task's context. It does so by exploiting the parasite code execution feature, which is also used to dump various process' information.
== Syntax ==
The command syntax is
<pre>
crtools exec -t <pid> <syscall-name> <syscall-arguments>
</pre>
The <code>syscall-name</code> is just a name of a system call. Since typically each syscall is wrapped with the respective glibc function, you can find out information about the interesting system call in the respective man page.
The rest of the command line is treated as <code>syscall-arguments</code>. Each command line argument in this list is converted into the system call argument by the following rules:
* If an argument starts with '&', the rest of it is copied to the target task's address space (it's allocated by remotely calling the <code>mmap</code> syscall) and the pointer to this area is passed as the system call argument
* Otherwise, the argument is converted into an <code>unsigned long</code> number with <code>strtol</code> and passed to system call directly
* Not specified arguments (if required by system call) are set to 0
In order to execute a system call for remote task, you don't have to be root -- you should only have rights to do debugging (strace) on it.
If you want to make task perform some action, that consists of several syscalls, you should first stop it with <code>SIG_STOP</code>.
== Examples ==
=== Re-opening stdout ===
You can close the 1st fd from a task and re-open it into some other file like this
<pre>
# crtools exec -t <pid> close 1
# crtools exec -t <pid> open '&<path-to-file>' 2
</pre>
In the 2nd string 2 means the <code>O_RDWR</code> opening mode.
=== Adding madvise-s to a mapping ===
You can tune the task's address space with <code>madvise</code> bits like this
<pre>
# crtools exec -t <pid> madvise <start> <lenght> <madvise-bits-value>
</pre>