Basic support for injector TID pinning (#935)

CERT-Polska · Jul 23, 2024 · 6d9a773 · 6d9a773
1 parent c5b56e8
commit 6d9a773
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 0 deletions.
diff --git a/drakrun/drakrun/lib/injector.py b/drakrun/drakrun/lib/injector.py
@@ -60,6 +60,11 @@ def _get_cmdline_generic(self, method: str) -> List[str]:
             hex(self.runtime_info.vmi_offsets.kpgd),
             "-m",
             method,
+            *(
+                ["-I", str(self.runtime_info.inject_tid)]
+                if self.runtime_info.inject_tid is not None
+                else []
+            ),
         ]
 
     def _get_cmdline_writefile(self, local: str, remote: str) -> List[str]:

diff --git a/drakrun/drakrun/lib/util.py b/drakrun/drakrun/lib/util.py
@@ -5,6 +5,7 @@
 import re
 import subprocess
 from dataclasses import dataclass, field
+from typing import Optional
 
 from dataclasses_json import config, dataclass_json
 
@@ -52,6 +53,7 @@ def from_tool_output(output: str) -> "VmiOffsets":
 class RuntimeInfo:
     vmi_offsets: VmiOffsets
     inject_pid: int
+    inject_tid: Optional[int] = None
 
     @staticmethod
     def load(file_path: str) -> "RuntimeInfo":