1

I have a gap in my understanding and tooling. Now I would prefer to use Radare2, but will consider any answer. Let's use this program as an example.

#include <stdio.h>
#include <unistd.h>

static char world[] = "world";

int main () {
  pid_t pid = getpid();
  printf("Hello %s!\n\tMy memory is at /proc/%d/mem\n", world, pid);
  sleep(60*60); // 1hr 
  return 1;
}

When that programs runs, I expect its layout be copied into memory. But in this case, there must be some computation in preparing the strings in printf to get get displayed in the terminal such that when that program is run before it sleeps I should be able to find this string in memory,

Hello world!
    My memory is at /proc/1923288/mem

Normally, I could find that pretty easily by attaching a debugger to a process. But this question isn't about that. Is it possible to find that string without debugging by assembling the contents in time from memory at /proc/1923288/mem, without the need to ever attach to the process, or pause execution (even if it's not atomic)?


In case my example above is not clear, imagine an IRC client that stores the chat log in memory. How can I retrieve that log, or examine the memory of that process without attaching a debugger to it?

2
  • what does it mean "by assembling the contents in time"? Jun 13 at 13:59
  • @PawełŁukasik as in, I know without stopping the process you'll have a live view of the memory and not a snapshot. So YMMV. Jun 13 at 15:32

1 Answer 1

0

You no longer need to ptrace() a process to read its memory, as long as you own the target process.

However, there is no computation to prepare the strings for printf(), the arguments are just pointers to somewhere in memory. When searching you'll find world[] is stored in a different segment than Hello %s....

00402000-00403000 r--p 00002000 fd:03 15505885
Hello %s!
    My memory is at /proc/%d/mem

00404000-00405000 rw-p 00003000 fd:03 15505885
world

Using readelf to map segments to sections, these look like .rodata and .dynamic on my system when compiled with gcc, but may vary given a different system or compiler.

So in summary, yes you can search the memory of your own processes, but beware that the arguments to printf() may not be in the same segments.

New contributor
Mega Tonnage is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.