Context
The mprotect_injector E2E test is skipped because the cheat runs as its own PID. The eBPF LSM file_mprotect hook only fires when is_protected(pid) is true. A real code injection attack does mmap+write+mprotect from within the game's address space.
Work
- New
cheats/mprotect_inject_via_ptrace.c: PTRACE_ATTACH to game, inject mmap+write+mprotect shellcode via PTRACE_POKEDATA, trigger execution from game's PID context
- Modify
scripts/verify.sh: replace skipped assertion with real detection check
Tests
2 new E2E assertions (mprotect detected, event emitted).
Part of v2.0.0
Context
The
mprotect_injectorE2E test is skipped because the cheat runs as its own PID. The eBPF LSMfile_mprotecthook only fires whenis_protected(pid)is true. A real code injection attack does mmap+write+mprotect from within the game's address space.Work
cheats/mprotect_inject_via_ptrace.c: PTRACE_ATTACH to game, inject mmap+write+mprotect shellcode via PTRACE_POKEDATA, trigger execution from game's PID contextscripts/verify.sh: replace skipped assertion with real detection checkTests
2 new E2E assertions (mprotect detected, event emitted).
Part of v2.0.0