改变Linux' ps'通过改变argv输出[0]

时间:2014-04-30 22:14:05

标签: linux centos6 argv ps

我试图让一个程序改变什么' ps'显示为进程的CMD名称,使用我推荐的简单覆盖argv [0]指向的内存的技术。这是我写的示例程序。

#include <iostream>
#include <cstring>
#include <sys/prctl.h>
#include <linux/prctl.h>
using std::cout;
using std::endl;
using std::memcpy;

int main(int argc, char** argv)  {
    if ( argc < 2 ) {
        cout << "You forgot to give new name." << endl;
        return 1;
    }

    // Set new 'ps' command name - NOTE that it can't be longer than
    // what was originally in argv[0]!

    const char *ps_name = argv[1];
    size_t arg0_strlen = strlen(argv[0]);
    size_t ps_strlen = strlen(ps_name);
    cout << "Original argv[0] is '" << argv[0] << "'" << endl;

    // truncate if needed
    size_t copy_len = (ps_strlen < arg0_strlen) ? ps_strlen+1 : arg0_strlen;
    memcpy((void *)argv[0], ps_name, copy_len);
    cout << "New name for ps is '" << argv[0] << "'" << endl;

    cout << "Now spin.  Go run ps -ef and see what command is." << endl;
    while (1) {};
}

输出结果为:

$ ./ps_test2 foo
Original argv[0] is './ps_test2'
New name for ps is 'foo'
Now spin.  Go run ps -ef and see what command is.

ps -ef的输出是:

5079     28952  9142 95 15:55 pts/20   00:00:08 foo _test2 foo
显然,&#34; foo&#34;插入,但它的null终止符被忽略或变成空白。原始argv [0]的尾部仍然可见。

我如何替换字符串&#39; ps&#39;打印?

1 个答案:

答案 0 :(得分:2)

您需要重写整个命令行,在Linux中将其存储为连续的缓冲区,其参数以零分隔。

类似的东西:

size_t cmdline_len = argv[argc-1] + strlen(argv[argc-1]) - argv[0];
size_t copy_len = (ps_strlen + 1 < cmdline_len) ? ps_strlen + 1 : cmdline_len;
memcpy(argv[0], ps_name, copy_len);
memset(argv[0] + copy_len, 0, cmdline_len - copy_len);