Remote syscall execution - Revision history

Xemul at 13:07, 13 July 2017

2017-07-13T13:07:04Z

Kir: add to deprecated category

2016-09-16T17:58:10Z

add to deprecated category

Xemul at 17:16, 16 September 2016

2016-09-16T17:16:15Z

Xemul at 10:44, 31 December 2014

2014-12-31T10:44:05Z

Paschalis Mpeis: /* Syntax */

2014-12-10T15:32:33Z

Syntax

Xemul: + @ args to exec

2013-06-07T20:44:39Z

+ @ args to exec

Kir: crtools -> criu

2013-04-30T16:39:42Z

crtools -> criu

Xemul: Created page describing 'exec' command.

2012-12-18T15:39:08Z

Created page describing 'exec' command.

New page

This page describes how the <code>exec</code> command in crtools works.

== Description ==

The <code>exec</code> command executes arbitrary system call from another task's context. It does so by exploiting the parasite code execution feature, which is also used to dump various process' information.

== Syntax ==

The command syntax is

<pre>
crtools exec -t <pid> <syscall-name> <syscall-arguments>
</pre>

The <code>syscall-name</code> is just a name of a system call. Since typically each syscall is wrapped with the respective glibc function, you can find out information about the interesting system call in the respective man page.

The rest of the command line is treated as <code>syscall-arguments</code>. Each command line argument in this list is converted into the system call argument by the following rules:

* If an argument starts with '&', the rest of it is copied to the target task's address space (it's allocated by remotely calling the <code>mmap</code> syscall) and the pointer to this area is passed as the system call argument

* Otherwise, the argument is converted into an <code>unsigned long</code> number with <code>strtol</code> and passed to system call directly

* Not specified arguments (if required by system call) are set to 0

In order to execute a system call for remote task, you don't have to be root -- you should only have rights to do debugging (strace) on it.
If you want to make task perform some action, that consists of several syscalls, you should first stop it with <code>SIG_STOP</code>.

== Examples ==

=== Re-opening stdout ===

You can close the 1st fd from a task and re-open it into some other file like this

<pre>
# crtools exec -t <pid> close 1
# crtools exec -t <pid> open '&<path-to-file>' 2
</pre>

In the 2nd string 2 means the <code>O_RDWR</code> opening mode.

=== Adding madvise-s to a mapping ===

You can tune the task's address space with <code>madvise</code> bits like this

<pre>
# crtools exec -t <pid> madvise <start> <lenght> <madvise-bits-value>
</pre>

← Older revision		Revision as of 13:07, 13 July 2017
Line 1:		Line 1:
−	~~This page describes how the <code>exec</code> command in criu works.~~	+	{{Note\|The exec action is in [[deprecation]] list and has been removed in [[Download/criu/3.0\|3.0]]. [[Compel]] is the new way of doing tricks described below}}
−
−	{{Note\|The exec action is in [[deprecation]] list and ~~soon will be~~ removed. [[Compel]] is the new way of doing tricks described below}}

	== Description ==		== Description ==

← Older revision		Revision as of 17:58, 16 September 2016
Line 52:		Line 52:

	[[Category:API]]		[[Category:API]]
		+	[[Category:Deprecated]]

← Older revision		Revision as of 17:16, 16 September 2016
Line 1:		Line 1:
	This page describes how the <code>exec</code> command in criu works.		This page describes how the <code>exec</code> command in criu works.
		+
		+	{{Note\|The exec action is in [[deprecation]] list and soon will be removed. [[Compel]] is the new way of doing tricks described below}}

	== Description ==		== Description ==

← Older revision		Revision as of 10:44, 31 December 2014
Line 48:		Line 48:
	# criu exec -t <pid> madvise <start> <lenght> <madvise-bits-value>		# criu exec -t <pid> madvise <start> <lenght> <madvise-bits-value>
	</pre>		</pre>
		+
		+	[[Category:API]]

@@ Line 19: / Line 19: @@
 * If an argument starts with '&', the rest of it is copied to the target task's address space (it's allocated by remotely calling the <code>mmap</code> syscall) and the pointer to this area is passed as the system call argument
-* If an argument starts with '@', the rest of is is considered to be a size of a memory buffer, pointer to which is passed into a syscall and which contents is printed on the screen after the syscall returns. Note, that before pushing the argument into the syscall, the memory is ''not'' initialized.
+* If an argument starts with '@', the rest of it is considered to be a size of a memory buffer, pointer to which is passed into a syscall and which contents is printed on the screen after the syscall returns. Note, that before pushing the argument into the syscall, the memory is ''not'' initialized.
 * Otherwise, the argument is converted into an <code>unsigned long</code> number with <code>strtol</code> and passed to system call directly

← Older revision		Revision as of 20:44, 7 June 2013
Line 18:		Line 18:

	* If an argument starts with '&', the rest of it is copied to the target task's address space (it's allocated by remotely calling the <code>mmap</code> syscall) and the pointer to this area is passed as the system call argument		* If an argument starts with '&', the rest of it is copied to the target task's address space (it's allocated by remotely calling the <code>mmap</code> syscall) and the pointer to this area is passed as the system call argument
		+
		+	* If an argument starts with '@', the rest of is is considered to be a size of a memory buffer, pointer to which is passed into a syscall and which contents is printed on the screen after the syscall returns. Note, that before pushing the argument into the syscall, the memory is ''not'' initialized.

	* Otherwise, the argument is converted into an <code>unsigned long</code> number with <code>strtol</code> and passed to system call directly		* Otherwise, the argument is converted into an <code>unsigned long</code> number with <code>strtol</code> and passed to system call directly

@@ Line 1: / Line 1: @@
-This page describes how the <code>exec</code> command in crtools works.
+This page describes how the <code>exec</code> command in criu works.
 == Description ==
@@ Line 10: / Line 10: @@
 <pre>
-crtools exec -t <pid> <syscall-name> <syscall-arguments>
+criu exec -t <pid> <syscall-name> <syscall-arguments>
 </pre>
@@ Line 33: / Line 33: @@
 <pre>
-# crtools exec -t <pid> close 1
+# criu exec -t <pid> close 1
-# crtools exec -t <pid> open '&<path-to-file>' 2
+# criu exec -t <pid> open '&<path-to-file>' 2
 </pre>
@@ Line 44: / Line 44: @@
 <pre>
-# crtools exec -t <pid> madvise <start> <lenght> <madvise-bits-value>
+# criu exec -t <pid> madvise <start> <lenght> <madvise-bits-value>
 </pre>