开发者

How to find all read-write memory address of a process in Linux/UNIX with C/C++ language?

开发者 https://www.devze.com 2023-02-10 21:38 出处:网络
Through /proc file system , it\'s probable to read memory mappings with /proc/PID_PROCESS/maps , but is there any native APIs that dedicated for this function in C/C++ ?

Through /proc file system , it's probable to read memory mappings with /proc/PID_PROCESS/maps , but is there any native APIs that dedicated for this function in C/C++ ?

i.e to find out memory address that are writable and readable for process with PID 9322:

%> awk -F "-| " '$3 ~ /rw/ { print $1 " " $2}' /proc/9322/maps
0804e000 0804f000
085ed000 0860e000
b7707000 b7708000
b7864000 b7865000
b7865000 b7868000
b7897000 b7898000
b78b6000 b78b7000
bfd2e000 bfd50000

And those address are passed into my program , but now i want to integrate this function directly into my C++ program.

For most effectiveness , if i want to support for other *BSD system , i would not be able to take 开发者_JAVA百科advantage of /proc system , and i think there should some method to generate e.g /proc/1/maps directly without reading them again there , correct if i'm wrong ^_^


Well, you could grab the PID of the process using:

pid_t pid = getpid();

Then, you could open the file /proc/PID/maps to and parse it into an array to determine which sets of memory are read-write.

Edit: The getpid() function requires #include <unistd.h>.


Unfortunately, there is no full library (to my knowledge) to do what you want here. There is a libproc as part of procps, however this is an internal API, and moreover probably only implements the functionality used by procps. It would certainly be nice if there was such a library - feel free to release one! - but for now you'll have to conditional-compile for each OS you're targetting, and use OS-specific APIs (for Linux, directly opening and reading the appropriate procfiles) directly.


Read the proc file like you read normal file.

eg.

  FILE *filep = fopen("/proc/9322/maps","r");
  char ch;
  while (ch != EOF){
    ch = fgetc(filep);
    printf("%c", ch);
  }


Take a look at these questions and answers:

  • Searching a process' memory on Linux
  • Dump memory of a process
  • Low-overhead way to access the memory space of a traced process?
0

精彩评论

暂无评论...
验证码 换一张
取 消