Linux Process Injection

Overview

Linux has no direct equivalents of Windows APIs like VirtualAllocEx, VirtualProtectEx, or CreateRemoteThread. Allocation, permission changes, and thread creation must be induced inside the target process rather than performed remotely. All live-process injection methods are gated by the ptrace access-check algorithm, which evaluates credentials, dumpability, capabilities, and LSM policy.

There are two primary injection models:

• Live process: modify an existing image with ptrace, /proc/<pid>/mem, or process_vm_writev. Use the model overwrite -> execute -> recover.
• Controlled launch or exec: arrange loading into a new image with LD_PRELOAD or seccomp user notification.

Consult the capability matrix for feasibility checks.

Workflow

1. Classify the lifecycle. Decide whether the target is already running or launched under injector control.
2. Profile the target. Identify architecture, ABI, mappings, RELRO, thread state, loader/libc, kernel features, and mitigations.
3. Validate prerequisites. Check ptrace and LSM/Yama policy, loader behavior, or parent-child seccomp support as applicable.
4. Separate staging from execution. Identify both where bytes or objects are placed and how control reaches them.