Linux - tampering with existing processes

Question

From what I understand about Linux process systems, you cannot really modify or tamper a currently running process (at least, there is no built-in function that I know of that is capable of such a task). But are there workarounds around that at all? Is it possible to say, pause a process to define/modify a variable in it, and then let it run again? For a simple example, would it be possible to pause a terminal window process, and change it's geometry settings before letting it run again?

Basically, I'm looking for insight whether it's possible or not, and if possible should I ever attempt it?

EDIT --- --- ---

Alright, I'm going to try to rephrase this question for better clarification: Say I have a running gnome terminal window with geometry 80x24. Is it possible WITHOUT killing and/or replacing the process to change the geometry to 81x25? As in put it on hold, apply the new changes, and then restart that same process? Or is it absolutely impossible?

Whoever flagged this down, could at least do the courtesy to explain why you did it? — IDDQD, May 10 '13 at 17:48
One way is to use crash on a live system. crash /boot/vmlinux-x.x.gz. There is also a kernel debugger available now. — Peter L., May 10 '13 at 17:53
@BasileStarynkevitch Never heard of it, and I don't think I have it installed. — IDDQD, May 10 '13 at 18:25

Basile Starynkevitch · Answer 1 · 2013-05-10T21:29:16.287

2

You may sometimes use ptrace(2) syscall (for example, the gdb debugger can attach to a process and change something in its data).

And there is also /proc/1234/ for process of pid 1234. See proc(5) and you could dare writing into /proc/1234/mem -with an appropriate file offset- with care (perhaps only if process 1234 is stopped - see lseek(2), read(2), write(2), mmap(2), pwrite(2), kill(2), sigaction(2) etc... Read also advanced linux programming). Also look into /proc/1234/maps

Also, related to changing the size of the terminal: the SIGWINCH (window changed signal) is related to this, see signal(7).I guess that friendly applications (e.g. emacs or vi) would handle it. The ncurses library handles it.

You could be interested by application checkpointing and the BLCR library, and perhaps by the GNU screen utility.

edited May 10 '13 at 21:29

answered May 10 '13 at 18:05

Basile Starynkevitch

223,805
18
296
547

Are proc contents modifiable? Or are they read only? – IDDQD May 10 '13 at 18:12
2

@S.T.A.L.K.E.R.: some of the files in `/proc` are writeable (at least by the owner). For example `/proc//mem` is an image of the process's memory -- if you write into it (after lseeking to the appropriate address), you'll modify that memory. – Chris Dodd May 10 '13 at 18:18
@Chris Ah, that's interesting. So it is possible to modify processes on the fly! Awesome. Also, what's 'Iseeking'? – IDDQD May 10 '13 at 18:22

score 1 · Answer 2 · edited May 23 '17 at 10:25

1

You could debug the running process with GDB. Here's a similar topic 'Can I use GDB to debug a running process?'.

edited May 23 '17 at 10:25

Community

1
1

answered May 10 '13 at 18:08

Alper

12,860
2
31
41

score 1 · Answer 3 · answered May 10 '13 at 18:17

1

If all you want is to resize an existing window you can use something like xdotool.

answered May 10 '13 at 18:17

ctn

2,887
13
23

Linux - tampering with existing processes

3 Answers3