I have a gap in my understanding and tooling. Now I would prefer to use Radare2, but will consider any answer. Let's use this program as an example.
#include <stdio.h>
#include <unistd.h>
static char world[] = "world";
int main () {
pid_t pid = getpid();
printf("Hello %s!\n\tMy memory is at /proc/%d/mem\n", world, pid);
sleep(60*60); // 1hr
return 1;
}
When that programs runs, I expect its layout be copied into memory. But in this case, there must be some computation in preparing the strings in printf to get get displayed in the terminal such that when that program is run before it sleeps I should be able to find this string in memory,
Hello world!
My memory is at /proc/1923288/mem
Normally, I could find that pretty easily by attaching a debugger to a process. But this question isn't about that. Is it possible to find that string without debugging by assembling the contents in time from memory at /proc/1923288/mem
, without the need to ever attach to the process, or pause execution (even if it's not atomic)?
In case my example above is not clear, imagine an IRC client that stores the chat log in memory. How can I retrieve that log, or examine the memory of that process without attaching a debugger to it?