1

So lets say I have access to a process and its mm_struct, is there a way that I can change one of the mappings or remove a mapping and create a temporary one so that I can allocate an amount smaller than a page and have memory written to that?

For instance, process write faults on an ADD instruction. I can get the address and size of the fault with relative ease. I allocate 8 bytes locally (largest single instruction size) and mess with the mappings so that the virtual address that faulted points to the first byte of those 8 bytes. Then single step the instruction to get the data that was intended for another page and then restore the original page back to the mapping. I'm just curious as to whether something other than a page can be used in the virtual memory area for a process.

Jesus Ramos
  • 22,940
  • 10
  • 58
  • 88

1 Answers1

2

The underlying architecture of your computer defines what you can and can't do with virtual memory. You haven't specified your architecture, but I'm pretty confident that it won't allow you to manage a unit any smaller than a page.

But to address a larger issue, why does the memory size matter? You need this allocation once per thread, only if its is faulty, and it will be allocated for a single user-space instruction. Just use a new, clean page to temporarily map into your process to get the written value. It's probably easier to write, and it has better security: it will avoid exposing kernel data to an untrusted (and obviously faulty) application.

Karmastan
  • 5,618
  • 18
  • 24
  • That's true as the memory overhead is not very much given it's only 4 or 8k for a page size even though at most it will only use the first 8 bytes. As a sidenote, would you happen to know the easiest way to single step a user space instruction (from kernel space obviously)? – Jesus Ramos Aug 08 '11 at 02:57
  • @Jesus: I don't know exactly, but I would start by looking at the code used in [`ptrace()`](http://linux.die.net/man/2/ptrace) to implement the `PTRACE_SINGLESTEP` request. – Karmastan Aug 08 '11 at 17:13