5 ms·

Pyrasite - Inject code into a running Python process

174 points by packetlss 15y ago

burgerbrain 15y ago
That's pretty wild. Obviously you can do similar with straight up gdb and C programs, but does this sort of thing exist with other languages? I'd be fairly interested in something like this for racket and ruby.
- jeremya 15y ago
  From a quick glance at the code, it looks like it is using gdb to call methods in the Python/C API. I agree, it is pretty neat.
- packetlss 15y ago
  Have you seen 'hijack'? https://github.com/ileitch/hijack https://github.com/ileitch/hijack
- maxs 15y ago
  Java (well, JVM) has method hotswapping. It's very useful for debugging and development. Because of static typing, you can't change classes to add new methods, but you can modify existing methods. (There is something called JRebel which does allow you to change classes but I find it a little hacky.)
- dustingetz 15y ago
  MS Detours[1] makes this easy in win32 processes. Stuff like this is useful for reverse engineers when prototyping hacks, security research, hooking kernel-level calls for e.g. packet filtering or AV, etc. Note that your run-of-the-mill antivirus will detect this, hacking processes in production is much harder. Here's an article describing how to do it by hand the naive way, they use minesweeper as the target: [2] [1] http://research.microsoft.com/en-us/projects/detours/ http://research.microsoft.com/en-us/projects/detours/ [2] http://uninformed.org/?v=1&a=7 http://uninformed.org/?v=1&a=7
- pwg 15y ago
  Tcl has had this capability for a very long time: http://wiki.tcl.tk/1055 http://wiki.tcl.tk/1055 Tkcon (http://wiki.tcl.tk/1878 http://wiki.tcl.tk/1878) makes use of the various methods Tcl provides to great effect.
- praptak 15y ago
  "Obviously you can do similar with straight up gdb and C programs" Yes, but it is a bit harder - unlike C, Python is designed to make things easily changeable at runtime.
onedognight 15y ago
TL;DR The code is mostly this with a nice wrapper. gdb_cmds = [ 'PyGILState_Ensure()', # Allow payloads to import modules alongside them 'PyRun_SimpleString("import sys; sys.path.insert(0, \\"%s\\");")' % os.path.dirname(self.filename), 'PyRun_SimpleString("execfile(\\"%s\\")")' % self.filename, 'PyGILState_Release($1)', ] self._run('gdb -p %d -batch %s' % (self.pid, ' '.join(["-eval-command='call %s'" % cmd for cmd in gdb_cmds])))
Davertron 15y ago
Can someone describe why this sort of thing would be useful? I'm not criticizing, I just can't think of a use case for this.
- burgerbrain 15y ago
  Debugging for one. Same reason you might want to attach to an already running C/C++ process with GDB. (This is perhaps less less powerful for that use (since it would currently lack any sort of manual flow control), but I think the benefits of it actually being a REPL might offset that for some uses.)
  - polemic 15y ago
    Yeah, that's what I was thinking. The one thing I miss after moving from PHP is xdebug :/ Profiling too?
- ehsanu1 15y ago
  I just did PyWeek (week-long python game competition), and this would have been great for seeing the effects of my code changes right away. I still had a workable solution: I wrote a script that watched for any .py files that have been saved, and if so, ran the game for 15 seconds.
- MostAwesomeDude 15y ago
  Meliae at any point in the process would be awesome for long-running servers.
- wladimir 15y ago
  Well, if you have a Python-based closed-source application, and you want to debug that, extend or change its functionality, or find out what happens inside it can be useful...
kevingadd 15y ago
If you're on Windows, an old project of mine has a more sophisticated take on this: https://github.com/kevingadd/shootblues https://github.com/kevingadd/shootblues You can inject a whole collection of scripts into one or more processes hosting a Python interpreter, load/unload scripts at runtime, and communicate between host processes via an RPC mechanism. The only interesting use for it I ever came up with was modding the EVE Online user interface. There are a bunch of scripts that use it at https://github.com/kevingadd/shootbluesscripts https://github.com/kevingadd/shootbluesscripts - some of them are kind of interesting, like a gateway that lets you interact with scripts via Jabber messages, and a HTML5 remote desktop that lets you play the game from a remote browser.
- sanswork 15y ago
  EVE Online was my first thought for this. Given the name of the script I'm assuming you're in the CF. Do you know if CCP have started actively looking for this type of thing? I know some/most bots use similar methods from what I've read but unfamiliarity with Python means I have no clue how easy it would be to detect.
  - kevingadd 15y ago
    They could trivially detect it but they don't seem to have made any effort. The confusing thing is that their EULA is worded in such a way that this kind of software is not actually in violation, so it's unclear whether they even intend to find people using these scripts. They tend to go after people who are visibly breaking the economy or cheating (and they do tend to use these techniques to do that). You can definitely play cat and mouse with a game developer when building this kind of software, but I consider it a waste of energy. In our case the alliance ended up using it mostly for data mining and not for anything malicious or directly in violation of the EULA, since we had thousands of players to keep track of and doing stuff by hand was tedious. At one point I was going to try and turn the HTML5 play-from-browser feature into a product and sell it for a buck, but CCP's community team (that supposedly approves for-sale addons/tools) doesn't respond to emails and WebKit has had an unfixed bug for years that causes it to crash your browser, so I shelved it.
johnthedebs 15y ago
This looks like a great little trick, but I can't get it to work on OS X Lion. Has anyone else on Lion gotten this to work? I've got Xcode 4.1 installed with dev tools, and it seems like the version of gdb provided doesn't support the -eval-command flag which breaks the script. I'm wondering if someone else can confirm this problem, and whether there is an easy way to to install a supported version of gdb.

174 points by packetlss 15y ago

That's pretty wild. Obviously you can do similar with straight up gdb and C programs, but does this sort of thing exist with other languages? I'd be fairly interested in something like this for racket and ruby.

jeremya 15y ago
From a quick glance at the code, it looks like it is using gdb to call methods in the Python/C API. I agree, it is pretty neat.
packetlss 15y ago
Have you seen 'hijack'? https://github.com/ileitch/hijack https://github.com/ileitch/hijack
maxs 15y ago
Java (well, JVM) has method hotswapping. It's very useful for debugging and development. Because of static typing, you can't change classes to add new methods, but you can modify existing methods. (There is something called JRebel which does allow you to change classes but I find it a little hacky.)
dustingetz 15y ago
MS Detours[1] makes this easy in win32 processes. Stuff like this is useful for reverse engineers when prototyping hacks, security research, hooking kernel-level calls for e.g. packet filtering or AV, etc. Note that your run-of-the-mill antivirus will detect this, hacking processes in production is much harder. Here's an article describing how to do it by hand the naive way, they use minesweeper as the target: [2] [1] http://research.microsoft.com/en-us/projects/detours/ http://research.microsoft.com/en-us/projects/detours/ [2] http://uninformed.org/?v=1&a=7 http://uninformed.org/?v=1&a=7
pwg 15y ago
Tcl has had this capability for a very long time: http://wiki.tcl.tk/1055 http://wiki.tcl.tk/1055 Tkcon (http://wiki.tcl.tk/1878 http://wiki.tcl.tk/1878) makes use of the various methods Tcl provides to great effect.
praptak 15y ago
"Obviously you can do similar with straight up gdb and C programs" Yes, but it is a bit harder - unlike C, Python is designed to make things easily changeable at runtime.

onedognight 15y ago

TL;DR The code is mostly this with a nice wrapper. gdb_cmds = [ 'PyGILState_Ensure()', # Allow payloads to import modules alongside them 'PyRun_SimpleString("import sys; sys.path.insert(0, \\"%s\\");")' % os.path.dirname(self.filename), 'PyRun_SimpleString("execfile(\\"%s\\")")' % self.filename, 'PyGILState_Release($1)', ] self._run('gdb -p %d -batch %s' % (self.pid, ' '.join(["-eval-command='call %s'" % cmd for cmd in gdb_cmds])))

Davertron 15y ago

Can someone describe why this sort of thing would be useful? I'm not criticizing, I just can't think of a use case for this.

burgerbrain 15y ago
Debugging for one. Same reason you might want to attach to an already running C/C++ process with GDB. (This is perhaps less less powerful for that use (since it would currently lack any sort of manual flow control), but I think the benefits of it actually being a REPL might offset that for some uses.)
- polemic 15y ago
  Yeah, that's what I was thinking. The one thing I miss after moving from PHP is xdebug :/ Profiling too?
ehsanu1 15y ago
I just did PyWeek (week-long python game competition), and this would have been great for seeing the effects of my code changes right away. I still had a workable solution: I wrote a script that watched for any .py files that have been saved, and if so, ran the game for 15 seconds.
MostAwesomeDude 15y ago
Meliae at any point in the process would be awesome for long-running servers.
wladimir 15y ago
Well, if you have a Python-based closed-source application, and you want to debug that, extend or change its functionality, or find out what happens inside it can be useful...

kevingadd 15y ago

If you're on Windows, an old project of mine has a more sophisticated take on this: https://github.com/kevingadd/shootblues https://github.com/kevingadd/shootblues You can inject a whole collection of scripts into one or more processes hosting a Python interpreter, load/unload scripts at runtime, and communicate between host processes via an RPC mechanism. The only interesting use for it I ever came up with was modding the EVE Online user interface. There are a bunch of scripts that use it at https://github.com/kevingadd/shootbluesscripts https://github.com/kevingadd/shootbluesscripts - some of them are kind of interesting, like a gateway that lets you interact with scripts via Jabber messages, and a HTML5 remote desktop that lets you play the game from a remote browser.

sanswork 15y ago
EVE Online was my first thought for this. Given the name of the script I'm assuming you're in the CF. Do you know if CCP have started actively looking for this type of thing? I know some/most bots use similar methods from what I've read but unfamiliarity with Python means I have no clue how easy it would be to detect.
- kevingadd 15y ago
  They could trivially detect it but they don't seem to have made any effort. The confusing thing is that their EULA is worded in such a way that this kind of software is not actually in violation, so it's unclear whether they even intend to find people using these scripts. They tend to go after people who are visibly breaking the economy or cheating (and they do tend to use these techniques to do that). You can definitely play cat and mouse with a game developer when building this kind of software, but I consider it a waste of energy. In our case the alliance ended up using it mostly for data mining and not for anything malicious or directly in violation of the EULA, since we had thousands of players to keep track of and doing stuff by hand was tedious. At one point I was going to try and turn the HTML5 play-from-browser feature into a product and sell it for a buck, but CCP's community team (that supposedly approves for-sale addons/tools) doesn't respond to emails and WebKit has had an unfixed bug for years that causes it to crash your browser, so I shelved it.

johnthedebs 15y ago

This looks like a great little trick, but I can't get it to work on OS X Lion. Has anyone else on Lion gotten this to work? I've got Xcode 4.1 installed with dev tools, and it seems like the version of gdb provided doesn't support the -eval-command flag which breaks the script. I'm wondering if someone else can confirm this problem, and whether there is an easy way to to install a supported version of gdb.