在Linux上读取和写入内存进程

Question

I wrote a small programm that read and write the memory of a process but I can't understand why it doesn't work. that's my code:

#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <sys/stat.h>
#include <sys/ptrace.h>
#include <errno.h>
#include <string.h>
#include <fcntl.h>


int main()
{
pid_t pid=3169;
char mem_file_name[2048];
 int mem_fd;
 int offset=0;
 char buf[1005128];

sprintf(mem_file_name, "/proc/%d/mem", pid);
mem_fd = open(mem_file_name, O_RDWR,S_IRWXU);
printf("1 %s\n",strerror(errno));
ptrace(PTRACE_ATTACH, pid, NULL, NULL);
printf("2 %s\n",strerror(errno));
waitpid(pid, NULL, 0);
printf("3 %s\n",strerror(errno));
lseek(mem_fd, offset, SEEK_SET);
printf("4 %s\n",strerror(errno));
read(mem_fd, buf, _SC_PAGE_SIZE);
printf("5 %s\n",strerror(errno));
ptrace(PTRACE_DETACH, pid, NULL, NULL);
printf("6 %s\n",strerror(errno));
printf("%s\n",buf );
}

that's my output:

1 Success
2 Success
3 Success
4 Success
5 Input/output error
6 Input/output error

I compiled with

gcc -Wall -Wextra main.c

and I run with root permission

sudo ./a.out

on this example I only try to read from a process, but it doesn't work. My idea is to dump the memory of a process, but I don't know why I can't read.

ps I know that there are some tools that can dump the memory of a process, but I want to create a small programm for exercise.

Answer 1

There are several things that goes wrong with your code.

Your main problem is that you are trying to read from offset 0, which is the process address 0x00000000 which is not mapped to your process.

int offset=0;
...
lseek(mem_fd, offset, SEEK_SET);

it is like reading from your memory at address zero:

int offset=0;
char* p = 0x0;
printf("%d data",p[offset]);

You can only read memory through /proc/PID/mem at offsets which are valid and mapped addresses in your process.

For example, if you want to read you buf variable's memory through this API you can read it by seeking to its address:

lseek(mem_fd, (off_t)buf, SEEK_SET); /* note that on 64 bit you need to use lseek64 and off64_t */
read(mem_fd, buf, _SC_PAGE_SIZE); /* this should work */

Notes:

• PID should not be hard coded, either you read it from getpid or you use /proc/self/mem
• There is no point in opening the file descriptor for writing (the proc API is read only)
• Suggest you reading http://man7.org/linux/man-pages/man5/proc.5.html as well