How to call linux syscall PROCESS_VM_READV within python? - linux

Question

I'm trying to learn how to call PROCESS_VM_READV within python. Reading from the manual, I've decided to create something similar to their example.
I've opened python3 in terminal with root access. Then proceeded by importing&initializing needed modules and variables
import ctypes
libc = ctypes.CDLL('libc.so.6')
vm=libc.process_vm_readv
In the example, there's a struct called iovec. So, I need to re-create it in python
class iovec(ctypes.Structure):
_fields_=[("iov_base",ctypes.c_void_p),("iov_len",ctypes.c_int)]
Then create the variables local and remote
p1=ctypes.c_char_p(b"")
p1=ctypes.cast(p1,ctypes.c_void_p)
local=iovec(p1,10)
remote=iovec(0x00400000,20) # Address of ELF header
Finally, calling PROCESS_VM_READV with pid of KMines
vm(2242,local,2,remote,1,0)
But it returns -1 and there are no changes in iov_base of local or remote. I feel like I'm doing a very simple mistake here but can't quite put my finger on it.
Any help is appreciated, have a nice day.

Answer 1

might be too late here but i was able to replicate the example from the man of process_vm_readv here
we need to pass a valid readable remote address, for testing purpose i compiled a simple hello world and used gdb to read a valid address
(gdb) break main
Breakpoint 1 at 0x5a9: file hello.c, line 4.
(gdb) run
Starting program: /user/Desktop/hello
=> 0x800005a9 <main+25>: sub esp,0xc
0x800005ac <main+28>: lea edx,[eax-0x19b0]
0x800005b2 <main+34>: push edx
0x800005b3 <main+35>: mov ebx,eax
0x800005b5 <main+37>: call 0x800003f0 <puts#plt>
0x800005ba <main+42>: add esp,0x10
0x800005bd <main+45>: nop
0x800005be <main+46>: lea esp,[ebp-0x8]
0x800005c1 <main+49>: pop ecx
0x800005c2 <main+50>: pop ebx
(gdb) x/20b 0x800005a9
0x800005a9 <main+25>: 0x83 0xec 0x0c 0x8d 0x90 0x50 0xe6 0xff
0x800005b1 <main+33>: 0xff 0x52 0x89 0xc3 0xe8 0x36 0xfe 0xff
0x800005b9 <main+41>: 0xff 0x83 0xc4 0x10
Below is the python code to retrieve the same results
from ctypes import *
class iovec(Structure):
_fields_ = [("iov_base",c_void_p),("iov_len",c_size_t)]
local = (iovec*2)() #create local iovec array
remote = (iovec*1)()[0] #create remote iovec
buf1 = (c_char*10)()
buf2 = (c_char*10)()
pid = 25117
local[0].iov_base = cast(byref(buf1),c_void_p)
local[0].iov_len = 10
local[1].iov_base = cast(byref(buf2),c_void_p)
local[1].iov_len = 10
remote.iov_base = c_void_p(0x800005a9) #pass valid readable address
remote.iov_len = 20
libc = CDLL("libc.so.6")
vm = libc.process_vm_readv
vm.argtypes = [c_int, POINTER(iovec), c_ulong, POINTER(iovec), c_ulong, c_ulong]
nread = vm(pid,local,2,remote,1,0)
if nread != -1:
bytes = "[+] "
print "[+] received %s bytes" % (nread)
for i in buf1: bytes += hex(ord(i)) + " "
for i in buf2: bytes += hex(ord(i)) + " "
print bytes
output
user#ubuntu:~/Desktop# python process_vm_readv.py
[+] received 20 bytes
[+] 0x83 0xec 0xc 0x8d 0x90 0x50 0xe6 0xff 0xff 0x52 0x89 0xc3 0xe8 0x36 0xfe 0xff 0xff 0x83 0xc4 0x10