Tofik Suleymanov wrote:
Diomidis Spinellis wrote:
Tofik Suleymanov wrote:
The only way you're going to be able to read another processes
address space is in the kernel.Even a process running as root is not
able to read another process's data.
Incorrect; see this example:
$ sed -e 's/this/that/' &
[1] 87345
$ /bin/su
Password:
# dd if=/proc/87345/mem conv=noerror 2> /dev/null | strings
[...]
@(#)compile.c 8.1 (Berkeley) 6/6/93
[...]
RE error: %s
RuneMagiNONE
/this/that/
"s/this/that/
s/this/that/
this
that
that
I followed instructions in your email, but had no success of getting
simmilar results. When trying to read from mem file of particular
process i get error messages from dd:
(many of this records populate the screen)
0 bytes transferred in 6.393733 secs (0 bytes/sec)
dd: /proc/13150/mem: Bad address
dd: /proc/13150/mem: Bad address
0+0 records in
0+0 records out
0 bytes transferred in 6.393795 secs (0 bytes/sec)
while pid 13510 exists:
paranoia# ps ax |grep 13150
13150 p1 T 0:00.00 sed -e s/this/that/g
paranoia#
man 5 procfs says:
mem The complete virtual memory image of the process. Only those
address which exist in the process can be accessed. Reads and
writes to this file modify the process. Writes to the text
seg-
ment remain private to the process.
map A map of the process' virtual memory.
I wonder why i cannot just dd data from mem ?
Not all areas of the process's memory are accessible. This is why I set
the conv=noerr option to dd (rather than run strings directly on mem),
and also redirected the dd's standard error output to /dev/null. Your
root's shell (probably tcsh) failed to do that. (Tcsh doesn't offer a
way to redirect just the error output). Run sh after the su command to
have this facility at your disposal.
Diomidis - http://www.spinellis.gr
_______________________________________________
freebsd-stable@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-stable
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
