Step-by-Step Linux Process Injection Guide on Mathscantor's Cybersecurity Blog

Step-by-Step Linux Process Injection Guide Part 3 - Shellcode and Remote Function Calls

Sun, 26 Jul 2026 12:37:00 +0800

1. Introduction

In Part 2 we attached to the target process and resolved the addresses of malloc(), free(), and dlopen() inside the target despite ASLR. We know where those functions live, but we have not called them yet.

This part covers the mechanism that makes remote function calls possible: a small shellcode trampoline. We will walk through how linworm finds an executable memory region in the target, backs up the original bytes and registers, writes the trampoline into place, and then uses it to invoke any function by manipulating registers and resuming execution with ptrace().

Step-by-Step Linux Process Injection Guide Part 2 - Attaching and Defeating ASLR

Sat, 18 Jul 2026 09:31:08 +0800

1. Introduction

Before we can inject anything, we need to do two things:

Attach to the target process so we can control it.
Figure out where libc functions like malloc() and dlopen() live inside the target’s address space.

This part covers both. The first half is about stopping the target with ptrace(). The second half is about defeating ASLR by resolving function addresses at runtime instead of hardcoding them.

Step-by-Step Linux Process Injection Guide Part 1 - Overview

Tue, 07 Jul 2026 23:51:00 +0800

1. Introduction

Process injection is a technique where one process forces another already-running process to load and execute arbitrary code. On Windows, the classic approach is CreateRemoteThread() combined with LoadLibrary(). On Linux, the equivalent relies on ptrace(). It’s the same system call that debuggers like GDB use to attach to processes, read and write their memory, and manipulate their registers.

This series walks through a full ptrace-based injection from start to finish. We will cover attaching to a target, setting up a shellcode trampoline, resolving function addresses despite ASLR, loading a shared library into the target’s address space, and restoring the target to its original state. By the end, you should understand every step well enough to read (or write) an injector yourself.