• pyinject.py — расширение GDB
• hook.py — модуль с функциями перехватчиками

gdb -ex 'attach PID' -ex 'source pyinject.py' -ex 'set hookfile hook.py'

0x7f6cc8aa83e0 <open64+0>:          83 3d ed 33 2d 00 00  cmpl    $0x0,0x2d33ed(%rip)
0x7f6cc8aa83e7 <open64+7>:          75 10                 jne     0x7f6cc8aa83f9 <open64+25>
0x7f6cc8aa83e9 <__open_nocancel+0>: b8 02 00 00 00        mov     $0x2,%eax
0x7f6cc8aa83ee <__open_nocancel+5>: 0f 05                 syscall

1. определить размер команд в начале функции
2. выделить память не дальше чем в 2ГБ от целевого адреса команды cmpl (смещение 0x2d33ed(%rip) знаковое 32-битное)
3. скопировать начало в новое место и пропатчить доступ к памяти относительно %rip в cmpl

# pyinject.py
import re
import os

RTLD_LAZY = 1
PROT_READ = 0x1
PROT_WRITE = 0x2
PROT_EXEC = 0x4
MAP_PRIVATE = 0x2
MAP_FIXED = 0x10
MAP_ANONYMOUS = 0x20
LIBPYTHON = 'libpython2.7.so'

class ParamHookfile(gdb.Parameter):
    instance = None
    def __init__(self, default=''):
        super(ParamHookfile, self).__init__("hookfile",
                                            gdb.COMMAND_NONE, gdb.PARAM_FILENAME)
        self.value = default
        ParamHookfile.instance = self

    def get_set_string(self):
        return self.value

    def get_show_string(self, svalue):
        return svalue

class CmdHook(gdb.Command):
    instance = None
    def __init__(self):
        super(CmdHook, self).__init__("pyinject", gdb.COMMAND_NONE)
        self.initialized = False
        CmdHook.instance = self

    def complete(self, text, word):
        matching = [s[4:] for s in dir(self)
                     if s.startswith('cmd_')
                     and s[4:].startswith(text)]
        return matching

    def invoke(self, subcmd, from_tty):
        self.dont_repeat()
        if subcmd.startswith("hook"):
            self.cmd_hook(*gdb.string_to_argv(subcmd))
        elif subcmd.startswith("unhook"):
            self.cmd_unhook(*gdb.string_to_argv(subcmd))
        else:
            gdb.write('unknown sub-command "%s"' % subcmd)

    def cmd_hook(self, *args):
        self.initialize()
        if not self.initialized:
            return

        pyret = gdb.parse_and_eval('PyRun_SimpleString("print Hook")')
        if long(pyret) != 0:
            hookfile = ParamHookfile.instance.value
            if not os.path.exists(hookfile):
                gdb.write('Use "set hookfile <path>"\n')
                return
            fp = gdb.parse_and_eval('fopen("%s", "r")' % hookfile)
            assert long(fp) != 0
            pyret = gdb.parse_and_eval('PyRun_AnyFileEx(%u, "%s", 1)' % (fp, hookfile))
            if long(pyret) != 0:
                gdb.write('Error loading "%s"\n' % hookfile)
                return

        for symbol in args:
            try:
                line = gdb.execute('info address %s' % symbol, False, True)
                m = re.match(r'.*?(0x[0-9a-f]+)', line)
                if m:
                    addr = int(m.group(1), 16)
            except gdb.error:
                continue
            prot = PROT_READ | PROT_WRITE | PROT_EXEC
            flags = MAP_PRIVATE | MAP_ANONYMOUS # | MAP_FIXED
            maddr = gdb.parse_and_eval('(void*)mmap(0x%x, %d, %d, %d, -1, 0)\n'
                                       % (addr | 0x7FFFFFFF , 4096, prot, flags))
            maddr = (long(maddr) & 0x00000000FFFFFFFF) | (addr & 0xFFFFFFFF00000000)
            gdb.write("mmap = 0x%x\n" % maddr)
            if maddr == 0:
                continue
            gdb.parse_and_eval('mprotect(0x%x, %u, %d)' % (addr & -0x1000, 4096*2, prot))
            pyret = gdb.parse_and_eval('PyRun_SimpleString("Hook.hook(\\"%s\\", 0x%x, 0x%x)")'
                                       % (symbol, addr, maddr))
            if long(pyret) == 0:
                gdb.write('hook "%s" OK\n' % symbol)

    def cmd_unhook(self, *args):
        for symbol in args:
            pyret = gdb.parse_and_eval('PyRun_SimpleString("Hook.unhook(\\"%s\\")")'
                                       % (symbol))
            if long(pyret) == 0:
                gdb.write('unhook "%s" OK\n' % symbol)

    def initialize(self):
        if self.initialized:
            return
        handle = gdb.parse_and_eval('dlopen("%s", %d)' % (LIBPYTHON, RTLD_LAZY))
        if not long(handle):
            gdb.write('Cannot load library %s\n' % LIBPYTHON)
            return
        if not long(gdb.parse_and_eval('Py_IsInitialized()')):
            gdb.execute('call PyEval_InitThreads()')
            gdb.execute('call Py_Initialize()')
        self.initialized = True

if __name__ == '__main__':
    ParamHookfile()
    CmdHook()

# hook.py
import struct
from ctypes import (CFUNCTYPE, POINTER, c_ubyte, c_int, c_char_p, c_void_p)

class Hook(object):
    all_hooks = {}

    @staticmethod
    def cast_to_void_p(pointer):
        return CFUNCTYPE(c_void_p, c_void_p)(lambda x: x)(pointer)

    @staticmethod
    def register(symbol, *args):
        Hook.all_hooks[symbol] = Hook(symbol, *args)

    def __init__(self, symbol, ctype, pyfunc):
        self.symbol = symbol
        self.ctype = ctype
        self.pyfunc = pyfunc
        self.cfunc = self.ctype(self.pyfunc)
        self.address = 0
        self.proxyaddr = 0
        self.jmp = None
        self.memory = None
        self.code = None
        self.active = False

    def install(self, address, proxyaddr):
        print "install:", hex(address)
        self.address = address
        self.proxyaddr = proxyaddr
        proxymemory = (c_void_p * 1).from_address(self.proxyaddr)
        proxymemory[0] = Hook.cast_to_void_p(self.cfunc)
        self.jmp = self.get_indlongjmp(self.address, self.proxyaddr)
        self.memory = (c_ubyte * len(self.jmp)).from_address(self.address)
        self.code = list(self.memory)
        self.patchmem(self.jmp)
        self.pyfunc.orig = self.origfunc()
        self.active = True

    def uninstall(self):
        self.patchmem(self.code)
        self.active = False

    def origfunc(self):
        ofunc = self.ctype(self.address)
        def wrap(*args):
            self.patchmem(self.code)
            val = ofunc(*args)
            self.patchmem(self.jmp)
            return val
        return wrap

    def patchmem(self, src):
        for i in range(len(src)):
            self.memory[i] = src[i]

    @staticmethod
    def get_indlongjmp(srcaddr, proxyaddr):
        # 64-bit indirect absolute jump (6 + 8 bytes)
        # ff 25 off32     jmpq  *off32(%rip)
        try:
            s = struct.pack('=BBl', 0xff, 0x25, proxyaddr - srcaddr - 6)
            return map(ord, s)
        except:
            print hex(proxyaddr), hex(srcaddr), hex(proxyaddr - srcaddr - 6)
            raise

    @staticmethod
    def hook(symbol, address, proxyaddr):
        h = Hook.all_hooks[symbol]
        if h.active:
            return
        h.install(address, proxyaddr)

    @staticmethod
    def unhook(symbol):
        h = Hook.all_hooks[symbol]
        if not h.active:
            return
        h.uninstall()

def hook(symbol, ctype):
    def deco(func):
        Hook.register(symbol, ctype, func)
        return func
    return deco

#int open (const char *__file, int __oflag, ...)
@hook(symbol='open', ctype=CFUNCTYPE(c_int, c_char_p, c_int))
def python_open(fname, oflag):
    print "open: ", fname, oflag
    return python_open.orig(fname, oflag)