http://www.cnblogs.com/LittleHann/p/4991600.htm

catalog

1. 应用场景
2. 通过Linux prctl修改进程名
3. 通过修改进程argv[0]修改进程名
4. 通过bash exec命令修改一个进程的cmdline信息

1. 应用场景

1. 标识父子进程名称，防止被误杀
2. 构造假的进程名及参数，引导非法进入人员到蜜罐系统，取证
3. 恶意程序、木马会通过"檫除"自己的进程名，使ps的时候显示的是一个无名字的进程，同时删除进程对应磁盘上的文件

l

Relevant Link:

http://blog.chinaunix.net/uid-29482215-id-4120748.html

2. 通过Linux prctl修改进程名

虽然Linux将所有资源对象都抽象为了文件，但是对一些特殊作用的文件特别定制了一些特别的API集合，对其进行特殊操作，prctl就是其中一个例子

1. prctl - operations on a process

2. #include <sys/prctl.h>

3. int prctl(int option, unsigned long arg2, unsigned long arg3,unsigned long arg4, unsigned long arg5);

prctl() is called with a first argument describing what to do (with values defined in <linux/prctl.h>), and further arguments with a significance depending on the first one. The first argument can be:

1. 1. PR_CAPBSET_READ

2. 2. PR_CAPBSET_DROP

3. 3. PR_SET_CHILD_SUBREAPER

4. 4. PR_GET_CHILD_SUBREAPER

5. 5. PR_SET_DUMPABLE

6. 6. PR_SET_ENDIAN

7. 7. PR_GET_ENDIAN

8. 8. PR_SET_FPEMU

9. 9. PR_GET_FPEMU

10. 10. PR_SET_FPEXC

11. 11. PR_GET_FPEXC

12. 12. PR_SET_KEEPCAPS

13. 13. PR_GET_KEEPCAPS

14. 14. PR_SET_NAME

15. 1) Set the name of the calling thread, using the value in the location pointed to by (char *) arg2.

16. 2) The name can be up to 16 bytes long, including the terminating null byte. (If the length of the string, including the terminating null byte, exceeds 16 bytes, the string is silently truncated.)

17. 3) This is the same attribute that can be set via pthread_setname_np and retrieved using pthread_getname_np.

18. 4) The attribute is likewise accessible via /proc/self/task/[tid]/comm, where tid is the name of the calling thread.

19. 15. PR_GET_NAME

20. 16. PR_SET_NO_NEW_PRIVS

21. 17. PR_GET_NO_NEW_PRIVS

22. 18. PR_SET_PDEATHSIG

23. 19. PR_GET_PDEATHSIG

24. 20. PR_SET_PTRACER

25. 21. PR_SET_SECCOMP

26. 22. PR_GET_SECCOMP

27. 23. PR_SET_SECUREBITS

28. 24. PR_GET_SECUREBITS

29. 25. PR_SET_THP_DISABLE

30. 26. PR_GET_THP_DISABLE

31. 27. PR_GET_TID_ADDRESS

32. 28. PR_SET_TIMERSLACK

33. 29. PR_GET_TIMERSLACK

34. 30. PR_SET_TIMING

35. 31. PR_GET_TIMING

36. 32. PR_TASK_PERF_EVENTS_DISABLE

37. 33. PR_TASK_PERF_EVENTS_ENABLE

38. 34. PR_SET_TSC

39. 35. PR_GET_TSC

40. 36. PR_SET_UNALIGN

41. 37. PR_GET_UNALIGN

42. 38. PR_MCE_KILL

43. 39. PR_MCE_KILL_GET

44. 40. PR_SET_MM

45. 41. PR_MPX_ENABLE_MANAGEMENT, PR_MPX_DISABLE_MANAGEMENT

0x1: Code Example

1. /*

2. gcc changetitle.c -o changetitle

3. */

4. #include <stdio.h>

5. #include <sys/prctl.h>

6. int main(int argc, char *argv[], char *envp[])

7. {

8. char *new_name = "littlehann-program";

9. getchar();

10. prctl(PR_SET_NAME, new_name);

11. getchar();

12. return 0;

13. }

但是prctl修改的进程名，只能是16个字节(包括'\0')，同时，过ps -aux 查看，进程名称并没有改变，改变的只是/prco/$(PID)/stat和/prco/$(PID)/status的值，而/prco/$(PID)/cmdline并没有改变

Relevant Link:

http://man7.org/linux/man-pages/man2/prctl.2.html
http://blog.csdn.net/dahailantian1/article/details/5950824
http://www.cppblog.com/beautykingdom/archive/2009/11/08/100419.aspx

3. 通过修改进程argv[0]修改进程名 

1. /*

2. gcc test.c -o test

3. */

4. #include <stdio.h>

5. #include <string.h>

6. extern char **environ;

7. int main(int argc , char *argv[])

8. {

9. int i;

10. printf("argc:%d\n" , argc);

11. for (i = 0; i < argc; ++i)

12. {

13. printf("argv[%d](0x%x):%s\n" , i , (unsigned int)argv[i], argv[i]);

14. }

15. printf("evriron=0x%x\n" , (unsigned int)environ[0]);

16. return 0;

17. }

通过代码运行结果可以看出，我们只需要在进程启动时修改argv[0]所指向的内存空间的内容，就可以修改进程名

1. 如果新名称比argv[0]的长度小，我们可以直接修改，并把多余的部分请0
2. 如果新名称比argv[0]长我们需要两步 
    1) 申请新内存保存环境变量信息和argv[1...argc-1]参数信息
    2) 修改argv[0]，将新名称往后到environ的最后一项清0

0x1: Code Example

1. /*

2. gcc changetitle.c -o changetitle

3. */

4. #include <unistd.h>

5. #include <stdio.h>

6. #include <stdarg.h>

7. #include <string.h>

8. #include <stdlib.h>

9. #include <sys/prctl.h>

10. # define MAXLINE 2048

11. extern char **environ;

12. static char **g_main_Argv = NULL; /* pointer to argument vector */

13. static char *g_main_LastArgv = NULL; /* end of argv */

14. void setproctitle_init(int argc, char **argv, char **envp)

15. {

16. int i;

17. for (i = 0; envp[i] != NULL; i++) // calc envp num

18. continue;

19. environ = (char **) malloc(sizeof (char *) * (i + 1)); // malloc envp pointer

20. for (i = 0; envp[i] != NULL; i++)

21. {

22. environ[i] = malloc(sizeof(char) * strlen(envp[i]));

23. strcpy(environ[i], envp[i]);

24. }

25. environ[i] = NULL;

26. g_main_Argv = argv;

27. if (i > 0)

28. g_main_LastArgv = envp[i - 1] + strlen(envp[i - 1]);

29. else

30. g_main_LastArgv = argv[argc - 1] + strlen(argv[argc - 1]);

31. }

32. void setproctitle(const char *fmt, ...)

33. {

34. char *p;

35. int i;

36. char buf[MAXLINE];

37. extern char **g_main_Argv;

38. extern char *g_main_LastArgv;

39. va_list ap;

40. p = buf;

41. va_start(ap, fmt);

42. vsprintf(p, fmt, ap);

43. va_end(ap);

44. i = strlen(buf);

45. if (i > g_main_LastArgv - g_main_Argv[0] - 2)

46. {

47. i = g_main_LastArgv - g_main_Argv[0] - 2;

48. buf[i] = '\0';

49. }

50. //修改argv[0]

51. (void) strcpy(g_main_Argv[0], buf);

52. p = &g_main_Argv[0][i];

53. while (p < g_main_LastArgv)

54. *p++ = '\0';

55. g_main_Argv[1] = NULL;

56. //调用prctl

57. prctl(PR_SET_NAME,buf);

58. }

59. int main(int argc, char *argv[])

60. {

61. char argv_buf[MAXLINE] = {0}; // save argv paramters

62. int i;

63. for( i = 1; i < argc; i++)

64. {

65. strcat(argv_buf, argv[i]);

66. strcat(argv_buf, " ");

67. }

68. //修改argv[0]所指向的内存空间的内容

69. setproctitle_init(argc, argv, environ);

70. //调用prctl修改进程名

71. setproctitle("%s@%s %s", "littlehann-prog", "ip", argv_buf);

72. for (i = 0; environ[i] != NULL; i++)

73. free(environ[i]);

74. getchar();

75. return 0;

76. }

Relevant Link:

http://blog.chinaunix.net/uid-29482215-id-4120748.html

4. 通过bash exec命令修改一个进程的cmdline信息

exec -l -a "littlehann-prog" bash
ps
ps -l 29116

Relevant Link:

http://blog.ailms.me/2014/05/24/bash-exec-usage-example.html

Copyright (c) 2015 LittleHann All rights reserved