OpenProcess / ReadProcessMemory / WriteProcessMemory / CloseHandle等效

Question

What would be the equivalent api to these Windows functions? In case you are not familiar with the windows functions, all they do is open a process, access(read and write) its memory and close its handle.

Can this be done with syscalls only as well?

Answer 1

You're looking for ptrace . Despite the name, it will also target individual threads on Linux and possibly other systems. More info can be found with Google if that blog post doesn't help.

Answer 2

If you're on a more modern kernel, you might try process_vm_readv which seems to more closely simulate ReadProcessMemory, only it works slightly more cleanly than ptrace and even the Windows equivalents.