freebsd stable - Jun 2006 - reading process memory

Hello, folks

I believe that it is possible to read contents of the memory 
used/utilized by a process (assuming right privileges).
First i've tried to do this through procfs by reading 'mem' property
of
the given process, but no success.
Maybe there is another way of doing such things ?
Any clue would be appreciated.

Thanks,
Tofik Suleymanov

How are you defining "assuming right privileges"?  The only way  
you're going to be able to read another processes address space is in  
the kernel.  Even a process running as root is not able to read  
another process's data.  One of the principle responsibilities of the  
OS is to manage the private memory space of each process, and I  
emphasize private.  The last thing you would want on a secure system  
is the ability of other processes to read or write to another  
process's address space.  Even a parent process should not be able to  
read a child's address space, as the fork logically duplicates their  
address space and they go their separate ways.  An attempt to read  
another processes address space should trap to the kernel and the  
kernel should kill the process immediately.  There is one exception  
to this:  you can setup a pipe or memory share between two processes,  
however, both processes have to agree to share some memory or connect  
via a pipe.  I'm not going to give you a howto via email as the  
subject usually fills a solid chapter in most OS books.

James Riendeau
MMI Computer Support Technician
1300 University Ave
Rm. 436, Dept. of MedMicro
Madison, WI  53706

Phone: (608) 262-3351
After-hours Phone: (608) 260-2696
Fax: (608) 262-8418
Email: jtriende@wisc.edu



On Jun 7, 2006, at 4:49 AM, Tofik Suleymanov wrote:
> Hello, folks
>
> I believe that it is possible to read contents of the memory used/ 
> utilized by a process (assuming right privileges).
> First i've tried to do this through procfs by reading 'mem'  
> property of the given process, but no success.
> Maybe there is another way of doing such things ?
> Any clue would be appreciated.
>
> Thanks,
> Tofik Suleymanov
> _______________________________________________
> freebsd-questions@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-questions
> To unsubscribe, send any mail to "freebsd-questions- 
> unsubscribe@freebsd.org"

Hello!

On Wed, 7 Jun 2006, Tofik Suleymanov wrote:
> I believe that it is possible to read contents of the memory used/utilized 
> by 
> a process (assuming right privileges).
  Yes, procfs allows it to user with the process's UID (or root).
> First i've tried to do this through procfs by reading 'mem'
property of the
> given process, but no success.
  Yes, process's virtual address space is accessible via
/proc/<PID>/mem file,
just don't forget that it's sparse. So you can't just 'hd
mem', you should
specify valid offset. /proc/<PID>/map will help you to do so:

dmitry@homelynx$ cd /proc/curproc
dmitry@homelynx$ cat map
0x8048000 0x80b0000 99 0 0xc68fc630 r-x 20 10 0x8004 COW NC vnode 
...
dmitry@homelynx$ dd if=mem bs=0x100 skip=0x80480 |hd|more
00000000  7f 45 4c 46 01 01 01 09  00 00 00 00 00 00 00 00  |.ELF............|
00000010  02 00 03 00 01 00 00 00  24 6e 05 08 34 00 00 00  |........$n..4...|
00000020  e0 ac 06 00 00 00 00 00  34 00 20 00 05 00 28 00  |??......4. ...(.|

P.S. I've once found the cause of the memory leak by examining virtual
address
space of my process and finding the repeated leaked pattern.
> Thanks,
> Tofik Suleymanov
Sincerely, Dmitry
-- 
Atlantis ISP, System Administrator
e-mail:  dmitry@atlantis.dp.ua
nic-hdl: LYNX-RIPE