如何将运行中myprog进程PID生成的字符串作为其参数传入？

Hey there, let's break down your problem and find a solid solution that doesn't rely on flaky PID offsets.

First, the Hard Truths You Need to Know #

1. Command-line arguments are set once at launch: When you start a program like ./myprog "hello", those arguments are passed via the execve system call. Once the process is running, you can't dynamically add or change its command-line arguments. Even editing /proc/$PID/cmdline only changes what's displayed in the proc filesystem—the process itself won't re-read or act on those changes.
2. Your myprog exits immediately without args: This means there's no "running instance" to send arguments to after launch. By the time you grab its PID and generate your string, the process is already gone.
3. PID offsets are never reliable: Kernel PID allocation is dynamic—there's no guarantee your script's PID plus 5 will match myprog's PID, especially on a busy CTF server with lots of processes spawning and exiting. That hack might work on your local Ubuntu, but it'll fail unpredictably elsewhere.

Practical Solutions to Meet Your Goal #

Your core goal seems to be running myprog with an argument generated from its own PID. Here's how to do that reliably:

Option 1: Use a Temporary File (If myprog can read input from a file)

If myprog supports reading data from a file (even if it normally takes command-line args), this is the cleanest approach:

#!/bin/bash
# Create a temporary file to hold our generated string
TMP_FILE=$(mktemp)

# Start myprog with the temp file as an argument (adjust the flag if needed, e.g., -f)
./myprog "$TMP_FILE" &
PID=$!

# Generate the string from the PID and write it to the temp file
STRING=$(./StringFromPid $PID)
echo "$STRING" > "$TMP_FILE"

# Wait for myprog to finish, then clean up the temp file
wait $PID
rm "$TMP_FILE"

Option 2: Restart myprog with the Generated String

If you can accept using the PID of the initial (exited) myprog instance to generate the argument for the running instance, this works:

#!/bin/bash
# Launch myprog without args (it exits immediately) and capture its PID
./myprog &
PID=$!
wait $PID  # Wait for it to exit

# Generate the string using that PID
STRING=$(./StringFromPid $PID)

# Launch myprog again with the generated string as the argument
./myprog "$STRING"

Option 3: Use gdb to Modify the Process (Advanced, Debug Permissions Required)

If the CTF server allows debugging tools like gdb, you can try attaching to myprog right after launch and modifying its arguments in memory. Note this is tricky and depends on myprog's memory layout:

#!/bin/bash
# Launch myprog without args in the background
./myprog &
PID=$!

# Generate the string from the PID
STRING=$(./StringFromPid $PID)

# Attach with gdb, set the new arguments, and resume execution
gdb -p $PID -batch -ex "set args $STRING" -ex "continue"

Warning: This might not work if myprog exits before gdb can attach, and you'll need to tweak the commands based on how myprog is structured.

Final Recommendation #

If myprog can read input from a file, go with Option 1—it's reliable and doesn't rely on hacks. If not, Option 2 is your safest bet for a portable solution that works without admin rights. Avoid the PID offset trick at all costs—it's a ticking time bomb in a shared environment like a CTF server.

内容的提问来源于stack exchange，提问作者Ablia