I want to add some extra funcionality to /bin/ls.
So I started it on gdb and added a breakpoint at the beginning.
Now question is: how can I change the code of a running program in memory? I can see the assembly code, but I’m not able to modify. How can I do it?
On Windows I can easily do this with olldbg for example. How about on Linux?
(I know that doing this I will only change the code of the process in memory. So then I can dump memory to a file, and then I’ll have my changes saved in a binary file).
Thank you.
You can write binary to memory directly but GDB doesn’t have an assembler build in by default you can however do something like
set *(unsigned char*)0x80FFDDEE = 0x90to change the mnemonic at that address to a NOP for example. You could however use NASM to write a shellcode and use perl or python to inject it into the program 🙂You might also like this little .gdbinit file to make debugging allot easier: https://gist.github.com/985474