https://mathscantor.github.io/tags/process_injection/ Recent content in Process_injection on Mathscantor's Cybersecurity Blog Hugo en <a href="https://creativecommons.org/licenses/by-nc/4.0/" target="_blank" rel="noopener">CC BY-NC 4.0</a> Tue, 07 Jul 2026 23:51:00 +0800 https://mathscantor.github.io/posts/linux-processing-injection-guide/part-1-overview/ Tue, 07 Jul 2026 23:51:00 +0800 https://mathscantor.github.io/posts/linux-processing-injection-guide/part-1-overview/ <h2 id="1-introduction">1. Introduction</h2> <p>Process injection is a technique where one process forces another already-running process to load and execute arbitrary code. On Windows, the classic approach is <span style="font-family: Courier, monospace; font-weight: 600;">CreateRemoteThread()</span> combined with <span style="font-family: Courier, monospace; font-weight: 600;">LoadLibrary()</span>. On Linux, the equivalent relies on <span style="font-family: Courier, monospace; font-weight: 600;">ptrace()</span>. It&rsquo;s the same system call that debuggers like GDB use to attach to processes, read and write their memory, and manipulate their registers.</p> <p>This series walks through a full ptrace-based injection from start to finish. We will cover attaching to a target, setting up a shellcode trampoline, resolving function addresses despite ASLR, loading a shared library into the target&rsquo;s address space, and restoring the target to its original state. By the end, you should understand every step well enough to read (or write) an injector yourself.</p>