You have to lseek() first, to the VMA you want to read. BTW you could use "/proc/self/mem" to avoid the formating with getpid()
On 13 May 2010 08:16, mobi phil <[email protected]> wrote: >> I tried to say that quite clear, procpidmem can only be used by >> - process itself >> - any parent process >> - any process that ptrace it > > do not want to tease you but in your prev email you said "own process > and their childs" and now you say "process itself and parent" ... > Anyway, I am sure it is clear what you mean. > > Nevertheless, I think I need your help or others to understand sthg... > I wanted to see, for general experience, what /proc/self/mem can offer > ... However I have a very strange behaviour: (see source code at the > end of the file).. > > I have the following output, that means I cannot read at (virtual) > address off buff... > > main, main memory: cp: 25109, pp: 25108, f: /proc/25108/mem, fd: 3, > read: -1, errno: Invalid argument > child, child memory: cp: 25109, pp: 25108, f: /proc/25109/mem, fd: 3, > read: -1, errno: Invalid argument > > > any hints? > > > rgrds > mobiphil > > int main() > { > char *fpat = "/proc/%d/mem"; > pid_t pp = getpid(); > char buff[100]; > pid_t cp; > char bb[1000]; > if( (cp = fork()) == 0) > { > cp = getpid(); //child > > sprintf(buff, fpat, cp); > int fd = open(buff, O_RDONLY ); > int s = pread(fd, bb, 10, buff); > printf("child, child memory: cp: %d, pp: %d, f: %s, fd: %d, > read: %d, errno: %s\n", > cp, pp, buff, fd, s, strerror(errno)); > > _exit(1); > } > else > { > sprintf(buff, fpat, pp); > int fd = open(buff, O_RDONLY ); > int s = read(fd, bb, buff); > printf("main, main memory: cp: %d, pp: %d, f: %s, fd: %d, read: > %d, errno: %s\n", > cp, pp, buff, fd, s, strerror(errno)); > > } > } > ~ > ~ > _______________________________________________ > radare mailing list > [email protected] > http://lists.nopcode.org/listinfo.cgi/radare-nopcode.org > -- There is a crack, a crack in everything. That's how the wine gets in. _______________________________________________ radare mailing list [email protected] http://lists.nopcode.org/listinfo.cgi/radare-nopcode.org
