Examining memory without attaching to the process by using /proc/$PID/mem?

Question

I have a gap in my understanding and tooling. Now I would prefer to use Radare2, but will consider any answer. Let's use this program as an example.

#include <stdio.h>
#include <unistd.h>

static char world[] = "world";

int main () {
  pid_t pid = getpid();
  printf("Hello %s!\n\tMy memory is at /proc/%d/mem\n", world, pid);
  sleep(60*60); // 1hr 
  return 1;
}

When that programs runs, I expect its layout be copied into memory. But in this case, there must be some computation in preparing the strings in printf to get get displayed in the terminal such that when that program is run before it sleeps I should be able to find this string in memory,

Hello world!
    My memory is at /proc/1923288/mem

Normally, I could find that pretty easily by attaching a debugger to a process. But this question isn't about that. Is it possible to find that string without debugging by assembling the contents in time from memory at /proc/1923288/mem, without the need to ever attach to the process, or pause execution (even if it's not atomic)?

---

In case my example above is not clear, imagine an IRC client that stores the chat log in memory. How can I retrieve that log, or examine the memory of that process without attaching a debugger to it?

Answer 1

You no longer need to ptrace() a process to read its memory, as long as you own the target process.

However, there is no computation to prepare the strings for printf(), the arguments are just pointers to somewhere in memory. When searching you'll find world[] is stored in a different segment than Hello %s....

00402000-00403000 r--p 00002000 fd:03 15505885
Hello %s!
    My memory is at /proc/%d/mem

00404000-00405000 rw-p 00003000 fd:03 15505885
world

Using readelf to map segments to sections, these look like .rodata and .dynamic on my system when compiled with gcc, but may vary given a different system or compiler.

So in summary, yes you can search the memory of your own processes, but beware that the arguments to printf() may not be in the same segments.

Answer 2

r2 can read/write memory to any process using /proc/pid/mem, it's actually the default way because it's much faster than using ptrace. But it does other attempts too in case that fails.

You can see the procpid io plugin listed in r2 -L vailable and you can do:

r2 procpid://$YOURFAVOURITEPID