0

I have a program that requires presence of specific device in system (afaik it checks /proc/bus/pci/devices for against list of hardcoded vendor_id:device_id pairs). How could I fool this software to think that device is present without having it physically connected? Is there any way to add a line to /proc/bus/pci/devices or intercept syscall from specific program and change it?

1
  • Could UDEV fake a device for you?
    – Jeremy Boden
    Jun 23, 2021 at 23:00

1 Answer 1

Reset to default
0

You should run strace on your program to figure out what "presence of specific device" means, exactly.

If it's really just reading that "file" as a normal file: well, easy, then just don't show the right file to that program!

That's what filesystem namespaces are for: isolating a program's view of the filesystem. (it's part of what container engines (think docker) tick.)

So, an unshare -m might help, after which you can mess around with your /proc mount to your heart's delight (hint: mount it somewhere else, use that as lower layer in an overlayfs to fake a "better" /proc/bus/pci/devices, comes with a caveat).

Also: this sounds like a rather straightforward thing to runtime-patch into your program. Run to startup, open() a text file that contains the desired line, giving you a new file descriptor to that, watchpoint on the "open()" syscall, catch when it opens /proc/bus/pci/devices, and if it's that, instead of returning the file descriptor of that, give the file descriptor to the text file.

3
  • I used strace before. Thats how I figured out how it checks if device is present. There is no open() syscall in systrace btw. Only read(). After that I went into the rabbit hole of trying to intercept read syscall. unshare -m did the trick, Thank you very much!
    – Asffu
    Jun 23, 2021 at 14:02
  • there has to be an open (or openat, or similar) call, otherwise read doesn't have anything to read from ;) read doesn't take a file name, it takes a file descriptor, and the only way to get these is to open them (or to get them sent via IPC, but let's not go there)
    – Marcus Müller
    Jun 23, 2021 at 14:09
  • 1
    Indeed there are few openat() calls. I did not know that there are other syscalls for opening files. Idk how but I always chose hardest path to solve problem at hand. Guess it's my lack of deeper understanding. At least I learned some cool stuff like LD_PRELOAD trick on the way and this unshare command
    – Asffu
    Jun 23, 2021 at 14:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .