http://www.cnblogs.com/LittleHann/p/4991600.htm

catalog

1. 应用场景
2. 通过Linux prctl修改进程名
3. 通过修改进程argv[0]修改进程名
4. 通过bash exec命令修改一个进程的cmdline信息
 

1. 应用场景
 

1. 标识父子进程名称，防止被误杀
2. 构造假的进程名及参数，引导非法进入人员到蜜罐系统，取证
3. 恶意程序、木马会通过"檫除"自己的进程名，使ps的时候显示的是一个无名字的进程，同时删除进程对应磁盘上的文件
 

l
 

Relevant Link:
 

http://blog.chinaunix.net/uid-29482215-id-4120748.html
 

 

2. 通过Linux prctl修改进程名
 

虽然Linux将所有资源对象都抽象为了文件，但是对一些特殊作用的文件特别定制了一些特别的API集合，对其进行特殊操作，prctl就是其中一个例子
 

 

  1.  
    prctl - operations on a process
     
  2.  
    #include <sys/prctl.h>
     
  3.  
    int prctl(int option, unsigned long arg2, unsigned long arg3,unsigned long arg4, unsigned long arg5);
     
 

prctl() is called with a first argument describing what to do (with values defined in <linux/prctl.h>), and further arguments with a significance depending on the first one. The first argument can be:
 

 

  1.  
    1. PR_CAPBSET_READ
     
  2.  
    2. PR_CAPBSET_DROP 
     
  3.  
    3. PR_SET_CHILD_SUBREAPER 
     
  4.  
    4. PR_GET_CHILD_SUBREAPER 
     
  5.  
    5. PR_SET_DUMPABLE 
     
  6.  
    6. PR_SET_ENDIAN 
     
  7.  
    7. PR_GET_ENDIAN 
     
  8.  
    8. PR_SET_FPEMU 
     
  9.  
    9. PR_GET_FPEMU 
     
  10.  
    10. PR_SET_FPEXC 
     
  11.  
    11. PR_GET_FPEXC 
     
  12.  
    12. PR_SET_KEEPCAPS 
     
  13.  
    13. PR_GET_KEEPCAPS 
     
  14.  
    14. PR_SET_NAME 
     
  15.  
    1) Set the name of the calling thread, using the value in the location pointed to by (char *) arg2. 
     
  16.  
    2) The name can be up to 16 bytes long, including the terminating null byte. (If the length of the string, including the terminating null byte, exceeds 16 bytes, the string is silently truncated.) 
     
  17.  
    3) This is the same attribute that can be set via pthread_setname_np and retrieved using pthread_getname_np. 
     
  18.  
    4) The attribute is likewise accessible via /proc/self/task/[tid]/comm, where tid is the name of the calling thread.
     
  19.  
    15. PR_GET_NAME 
     
  20.  
    16. PR_SET_NO_NEW_PRIVS 
     
  21.  
    17. PR_GET_NO_NEW_PRIVS 
     
  22.  
    18. PR_SET_PDEATHSIG 
     
  23.  
    19. PR_GET_PDEATHSIG 
     
  24.  
    20. PR_SET_PTRACER 
     
  25.  
    21. PR_SET_SECCOMP 
     
  26.  
    22. PR_GET_SECCOMP 
     
  27.  
    23. PR_SET_SECUREBITS 
     
  28.  
    24. PR_GET_SECUREBITS 
     
  29.  
    25. PR_SET_THP_DISABLE 
     
  30.  
    26. PR_GET_THP_DISABLE 
     
  31.  
    27. PR_GET_TID_ADDRESS 
     
  32.  
    28. PR_SET_TIMERSLACK 
     
  33.  
    29. PR_GET_TIMERSLACK 
     
  34.  
    30. PR_SET_TIMING 
     
  35.  
    31. PR_GET_TIMING 
     
  36.  
    32. PR_TASK_PERF_EVENTS_DISABLE 
     
  37.  
    33. PR_TASK_PERF_EVENTS_ENABLE 
     
  38.  
    34. PR_SET_TSC 
     
  39.  
    35. PR_GET_TSC 
     
  40.  
    36. PR_SET_UNALIGN
     
  41.  
    37. PR_GET_UNALIGN
     
  42.  
    38. PR_MCE_KILL 
     
  43.  
    39. PR_MCE_KILL_GET 
     
  44.  
    40. PR_SET_MM 
     
  45.  
    41. PR_MPX_ENABLE_MANAGEMENT, PR_MPX_DISABLE_MANAGEMENT
     
 

0x1: Code Example
 

 

  1.  
    /*
     
  2.  
    gcc changetitle.c -o changetitle
     
  3.  
    */
     
  4.  
    #include <stdio.h>
     
  5.  
    #include <sys/prctl.h>
     
  6.  
    int main(int argc, char *argv[], char *envp[])
     
  7.  
    {
     
  8.  
    char *new_name = "littlehann-program";
     
  9.  
    getchar();
     
  10.  
    prctl(PR_SET_NAME, new_name);
     
  11.  
    getchar();
     
  12.  
    return 0;
     
  13.  
    }
     
 

但是prctl修改的进程名，只能是16个字节(包括'\0')，同时，过ps -aux 查看，进程名称并没有改变，改变的只是/prco/$(PID)/stat和/prco/$(PID)/status的值，而/prco/$(PID)/cmdline并没有改变
 

Relevant Link:
 

http://man7.org/linux/man-pages/man2/prctl.2.html
http://blog.csdn.net/dahailantian1/article/details/5950824
http://www.cppblog.com/beautykingdom/archive/2009/11/08/100419.aspx
 

3. 通过修改进程argv[0]修改进程名 
 

 

  1.  
    /*
     
  2.  
    gcc test.c -o test
     
  3.  
    */
     
  4.  
    #include <stdio.h>
     
  5.  
    #include <string.h>
     
  6.  
    extern char **environ;
     
  7.  
    int main(int argc , char *argv[])
     
  8.  
    {
     
  9.  
    int i;
     
  10.  
    printf("argc:%d\n" , argc);
     
  11.  
    for (i = 0; i < argc; ++i)
     
  12.  
    {
     
  13.  
    printf("argv[%d](0x%x):%s\n" , i , (unsigned int)argv[i], argv[i]);
     
  14.  
    }
     
  15.  
    printf("evriron=0x%x\n" , (unsigned int)environ[0]);
     
  16.  
    return 0;
     
  17.  
    }
     
 

通过代码运行结果可以看出，我们只需要在进程启动时修改argv[0]所指向的内存空间的内容，就可以修改进程名
 

1. 如果新名称比argv[0]的长度小，我们可以直接修改，并把多余的部分请0
2. 如果新名称比argv[0]长我们需要两步 
    1) 申请新内存保存环境变量信息和argv[1...argc-1]参数信息
    2) 修改argv[0]，将新名称往后到environ的最后一项清0
 

0x1: Code Example
 

 

  1.  
    /*
     
  2.  
    gcc changetitle.c -o changetitle
     
  3.  
    */
     
  4.  
    #include <unistd.h>
     
  5.  
    #include <stdio.h>
     
  6.  
    #include <stdarg.h>
     
  7.  
    #include <string.h>
     
  8.  
    #include <stdlib.h>
     
  9.  
    #include <sys/prctl.h>
     
  10.  
    # define MAXLINE 2048
     
  11.  
    extern char **environ;
     
  12.  
    static char **g_main_Argv = NULL; /* pointer to argument vector */
     
  13.  
    static char *g_main_LastArgv = NULL; /* end of argv */
     
  14.  
    void setproctitle_init(int argc, char **argv, char **envp)
     
  15.  
    {
     
  16.  
    int i;
     
  17.  
    for (i = 0; envp[i] != NULL; i++) // calc envp num
     
  18.  
    continue;
     
  19.  
    environ = (char **) malloc(sizeof (char *) * (i + 1)); // malloc envp pointer
     
  20.  
    for (i = 0; envp[i] != NULL; i++)
     
  21.  
    {
     
  22.  
    environ[i] = malloc(sizeof(char) * strlen(envp[i]));
     
  23.  
    strcpy(environ[i], envp[i]);
     
  24.  
    }
     
  25.  
    environ[i] = NULL;
     
  26.  
    g_main_Argv = argv;
     
  27.  
    if (i > 0)
     
  28.  
    g_main_LastArgv = envp[i - 1] + strlen(envp[i - 1]);
     
  29.  
    else
     
  30.  
    g_main_LastArgv = argv[argc - 1] + strlen(argv[argc - 1]);
     
  31.  
    }
     
  32.  
    void setproctitle(const char *fmt, ...)
     
  33.  
    {
     
  34.  
    char *p;
     
  35.  
    int i;
     
  36.  
    char buf[MAXLINE];
     
  37.  
    extern char **g_main_Argv;
     
  38.  
    extern char *g_main_LastArgv;
     
  39.  
    va_list ap;
     
  40.  
    p = buf;
     
  41.  
    va_start(ap, fmt);
     
  42.  
    vsprintf(p, fmt, ap);
     
  43.  
    va_end(ap);
     
  44.  
    i = strlen(buf);
     
  45.  
    if (i > g_main_LastArgv - g_main_Argv[0] - 2)
     
  46.  
    {
     
  47.  
    i = g_main_LastArgv - g_main_Argv[0] - 2;
     
  48.  
    buf[i] = '\0';
     
  49.  
    }
     
  50.  
    //修改argv[0]
     
  51.  
    (void) strcpy(g_main_Argv[0], buf);
     
  52.  
    p = &g_main_Argv[0][i];
     
  53.  
    while (p < g_main_LastArgv)
     
  54.  
    *p++ = '\0';
     
  55.  
    g_main_Argv[1] = NULL;
     
  56.  
    //调用prctl
     
  57.  
    prctl(PR_SET_NAME,buf);
     
  58.  
    }
     
  59.  
    int main(int argc, char *argv[])
     
  60.  
    {
     
  61.  
    char argv_buf[MAXLINE] = {0}; // save argv paramters
     
  62.  
    int i;
     
  63.  
    for( i = 1; i < argc; i++)
     
  64.  
    {
     
  65.  
    strcat(argv_buf, argv[i]);
     
  66.  
    strcat(argv_buf, " ");
     
  67.  
    }
     
  68.  
    //修改argv[0]所指向的内存空间的内容
     
  69.  
    setproctitle_init(argc, argv, environ);
     
  70.  
    //调用prctl修改进程名
     
  71.  
    setproctitle("%s@%s %s", "littlehann-prog", "ip", argv_buf);
     
  72.  
    for (i = 0; environ[i] != NULL; i++)
     
  73.  
    free(environ[i]);
     
  74.  
    getchar();
     
  75.  
    return 0;
     
  76.  
    }
     
 

Relevant Link:
 

http://blog.chinaunix.net/uid-29482215-id-4120748.html
 

4. 通过bash exec命令修改一个进程的cmdline信息
 

exec -l -a "littlehann-prog" bash
ps
ps -l 29116
 

Relevant Link:
 

http://blog.ailms.me/2014/05/24/bash-exec-usage-example.html
 

Copyright (c) 2015 LittleHann All rights reserved
 
  

        # linux
      
  
 
 Logo 
Linux
 
 
 
  
更多推荐
  
 
网卡速率和双工模式的配置
 
http://linux.chinaitlab.com/system/792187.html1、mii-tool 配置网络设备协商方式的工具；    1.1 mii-tool 介绍；    mii-tool - view, manipulate media-independent interface status （mii-tool 是查看，管理介质的网络接口的状态）
 
avatar Linux
 
 
Linux虚拟文件系统之文件系统卸载（sys_umount())
 
Linux中卸载文件系统由umount系统调用实现，入口函数为sys_umount()。较于文件系统的安装较为简单，下面是具体的实现。1. /*sys_umont系统调用*/2. SYSCALL_DEFINE2(umount, char __user *, name, int, flags)3. {4.struct path path;
 
avatar Linux
 
 
Linux系统下超级终端Minicom的使用方法（例如：连接交换机，路由器等）转http://baike.baidu.com/view/2911642.htm?fr=ala0_1
 
<br />　　Linux系统下超级终端Minicom的使用方法 <br />　　Linux下的Minicom的功能与下的超级终端功能相似，适于在通过超级终端对设备的管理以及对嵌入操作系统的升级，现写出Minicom的使用手册： <br />　　1． 启动minicom <br />　　以root权限登录系统 <br />　　使用命令 <br />　　minicom –s 则minicom启动，屏
 
avatar Linux