Pseudo Graceful Process Termination Through Code Injection(sigma-star.at)
sigma-star.at
Pseudo Graceful Process Termination Through Code Injection
https://sigma-star.at/blog/2024/02/exit0-code-injection/
4 comments
This is cute, but why not just do this with gdb? All-stop mode is on by default so it will stop all threads when you attach, and then you can simply invoke the exit_group() syscall.
syscall is only available if gdb is able to resolve libc. So for example this won’t work to stop a process running in a container, since gdb won’t be able to see the libc in the container’s filesystem. I did make my own variant using gdb, though, nicely explained here: https://thomasw.dev/post/killbutmakeitlooklikeanaccident/
I guess one goal of the experiment was understanding and learning how to do it by hand (in C) instead of relying on gdb.
> However, what if the need arises to forcefully terminate a process, disguising it as a successful exit? ... Since the parent process would detect the non-zero exit code, there was a high likelihood of making things worse.
I'm still trying to imagine what situation that is. I still cannot think about any real case where this is something you need.
If there is, I guess this is a very rare case? As it was already commented, I guess just gdb then?
But the technical details on how they do it are interesting nevertheless.
I'm still trying to imagine what situation that is. I still cannot think about any real case where this is something you need.
If there is, I guess this is a very rare case? As it was already commented, I guess just gdb then?
But the technical details on how they do it are interesting nevertheless.
One use case I have faced more than once are stuck processes in legacy build systems. For example, generating docs takes ages. Just killing the generator process will fail the build because the parent will notice. And since the build system is buggy/old, restarting the build will start from zero.
[deleted]
how can we build a tool to stop a process forcefully but make it look like a successful termination? As far as I know, Linux doesn’t provide an API to perform such a kill.
Interestingly, Windows does:
https://learn.microsoft.com/en-us/windows/win32/api/processt...
Interestingly, Windows does:
https://learn.microsoft.com/en-us/windows/win32/api/processt...
Using gdb is probably easier.