Inject code into a running process
C++ C
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Failed to load latest commit information.
LICENSE version and LICENSE file Jan 26, 2009
Makefile cleanup Mar 4, 2009
README added link to technical details Mar 16, 2010
client.c proxy window size changes (& SIGWINCH) Jan 26, 2009 compile fix for older systems Mar 4, 2009 compile fix for older systems Mar 4, 2009
injcode.h cleanup Mar 4, 2009 include <cstdio> for gcc 4.4.3 (at least) Mar 9, 2010
inject.h cleanup Mar 4, 2009 include <cstdio> for gcc 4.4.3 (at least) Mar 9, 2010
shellcode-close-linux-ia32.S dup2 module Mar 4, 2009
shellcode-dup2-linux-ia32.S shellcode error handling Mar 4, 2009
shellcode-retty-linux-ia32.S dup2 module Mar 4, 2009
shellcode-test-linux-ia32.S dup2 module Mar 4, 2009 dup2 module Mar 4, 2009


:Author: Thomas Habets
:Copyright: GPL

Just type "make", and then put the binary (injcode) wherever you like.

How it works
Injcode attaches to the target process using ptrace(). It then copies code
and data into the memory space of the process and runs that. Then it cleans
up as if it was never there.

It places the code and data in the current code and data page, respectively.
This ensures that no stack execution protection blocks it.

The code injected can be anything, but currently these are implemented:
- test     Prints a message to stdout in the context of the target process.
- close    Close any file descriptor. (see /proc/<pid>/fd)
- dup2     Overwrite any fd with a newly opened file.
- retty    Move a program from another tty to this one.

Doing retty is quite involved. See:
for the full story.


Example 1: move irssi from one terminal to another
Maybe move it into a screen.

First start irssi in one terminal.

Run injcode in another terminal:
  $ injcode -m retty <pid of irssi>

Irssi should now be moved to the second terminal, including having a new 
controlling terminal.

Example 2: redirect stdout of a running program into a file
  $ injcode -m dup2 \
  -ofd=1 \
  -ofilename=logfile.txt <pid of program>

See bug list/wishist using BugsEverywhere.

This file is written in
`reStructuredText <>`_