Editing registers (RIP specifically) with ptrace and PTRACE_POKEUSER

72 Views Asked by At

Apparently, something like this is (probably) possible, though ptrace's manual is a little ambiguous. Can someone elaborate on how I'd use PTRACE_POKEUSER to modify the user-space of the paused process (and maybe add some sample code), along with how I wouldn't, since the PTRACE_POKEUSER section of the docs says something about disallowing some activities? Specifically, I'm looking to modify the RIP register, if that means anything.

Thanks.

0

There are 0 best solutions below