linux - Can GDB change the assembly code of a running program?

Question

I want to add some extra funcionality to /bin/ls.
So I started it on gdb and added a breakpoint at the beginning.

Now question is: how can I change the code of a running program in memory? I can see the assembly code, but I'm not able to modify. How can I do it?

On Windows I can easily do this with olldbg for example. How about on Linux?

(I know that doing this I will only change the code of the process in memory. So then I can dump memory to a file, and then I'll have my changes saved in a binary file).

Thank you.

Answer 1

You can write binary to memory directly but GDB doesn't have an assembler build in by default you can however do something like set *(unsigned char*)0x80FFDDEE = 0x90 to change the mnemonic at that address to a NOP for example. You could however use NASM to write a shellcode and use perl or python to inject it into the program :)

You might also like this little .gdbinit file to make debugging allot easier: https://gist.github.com/985474