Pyrasite - Inject code into a running Python process | Hacker News Reader

Pyrasite - Inject code into a running Python process

fedorahosted.org

174 pointspacketlss18 comments

TL;DR The code is mostly this with a nice wrapper.

       gdb_cmds = [
            'PyGILState_Ensure()',
            # Allow payloads to import modules alongside them
            'PyRun_SimpleString("import sys; sys.path.insert(0, \\"%s\\");")' %
                os.path.dirname(self.filename),
            'PyRun_SimpleString("execfile(\\"%s\\")")' % self.filename,
            'PyGILState_Release($1)',
            ]
        self._run('gdb -p %d -batch %s' % (self.pid,
            ' '.join(["-eval-command='call %s'" % cmd for cmd in gdb_cmds])))

If you're on Windows, an old project of mine has a more sophisticated take on this:

https://github.com/kevingadd/shootblues

You can inject a whole collection of scripts into one or more processes hosting a Python interpreter, load/unload scripts at runtime, and communicate between host processes via an RPC mechanism.

The only interesting use for it I ever came up with was modding the EVE Online user interface. There are a bunch of scripts that use it at https://github.com/kevingadd/shootbluesscripts - some of them are kind of interesting, like a gateway that lets you interact with scripts via Jabber messages, and a HTML5 remote desktop that lets you play the game from a remote browser.

EVE Online was my first thought for this. Given the name of the script I'm assuming you're in the CF. Do you know if CCP have started actively looking for this type of thing? I know some/most bots use similar methods from what I've read but unfamiliarity with Python means I have no clue how easy it would be to detect.

They could trivially detect it but they don't seem to have made any effort. The confusing thing is that their EULA is worded in such a way that this kind of software is not actually in violation, so it's unclear whether they even intend to find people using these scripts. They tend to go after people who are visibly breaking the economy or cheating (and they do tend to use these techniques to do that). You can definitely play cat and mouse with a game developer when building this kind of software, but I consider it a waste of energy.

In our case the alliance ended up using it mostly for data mining and not for anything malicious or directly in violation of the EULA, since we had thousands of players to keep track of and doing stuff by hand was tedious.

At one point I was going to try and turn the HTML5 play-from-browser feature into a product and sell it for a buck, but CCP's community team (that supposedly approves for-sale addons/tools) doesn't respond to emails and WebKit has had an unfixed bug for years that causes it to crash your browser, so I shelved it.

That's pretty wild. Obviously you can do similar with straight up gdb and C programs, but does this sort of thing exist with other languages? I'd be fairly interested in something like this for racket and ruby.

From a quick glance at the code, it looks like it is using gdb to call methods in the Python/C API. I agree, it is pretty neat.

Have you seen 'hijack'?

https://github.com/ileitch/hijack

Java (well, JVM) has method hotswapping. It's very useful for debugging and development. Because of static typing, you can't change classes to add new methods, but you can modify existing methods. (There is something called JRebel which does allow you to change classes but I find it a little hacky.)

MS Detours[1] makes this easy in win32 processes. Stuff like this is useful for reverse engineers when prototyping hacks, security research, hooking kernel-level calls for e.g. packet filtering or AV, etc. Note that your run-of-the-mill antivirus will detect this, hacking processes in production is much harder.

Here's an article describing how to do it by hand the naive way, they use minesweeper as the target: [2]

[1] http://research.microsoft.com/en-us/projects/detours/ [2] http://uninformed.org/?v=1&a=7

Tcl has had this capability for a very long time: http://wiki.tcl.tk/1055

Tkcon (http://wiki.tcl.tk/1878) makes use of the various methods Tcl provides to great effect.

"Obviously you can do similar with straight up gdb and C programs"

Yes, but it is a bit harder - unlike C, Python is designed to make things easily changeable at runtime.

This looks like a great little trick, but I can't get it to work on OS X Lion. Has anyone else on Lion gotten this to work?

I've got Xcode 4.1 installed with dev tools, and it seems like the version of gdb provided doesn't support the -eval-command flag which breaks the script.

I'm wondering if someone else can confirm this problem, and whether there is an easy way to to install a supported version of gdb.

Can someone describe why this sort of thing would be useful? I'm not criticizing, I just can't think of a use case for this.

Debugging for one. Same reason you might want to attach to an already running C/C++ process with GDB.

(This is perhaps less less powerful for that use (since it would currently lack any sort of manual flow control), but I think the benefits of it actually being a REPL might offset that for some uses.)

Yeah, that's what I was thinking. The one thing I miss after moving from PHP is xdebug :/

Profiling too?

I just did PyWeek (week-long python game competition), and this would have been great for seeing the effects of my code changes right away.

I still had a workable solution: I wrote a script that watched for any .py files that have been saved, and if so, ran the game for 15 seconds.

Meliae at any point in the process would be awesome for long-running servers.

Well, if you have a Python-based closed-source application, and you want to debug that, extend or change its functionality, or find out what happens inside it can be useful...

Reply on news.ycombinator.com