Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am using a redis Database and would like to explore the contents of the RAM the application is using.

I feel the explanation of why I want to do this will make more sense then the question I would ask.

Redis is a simple key value store that stores binary data. I think it would be a good place to explore things like encoding and it would be interesting to me to do things like skimming over the RAM looking for binary sets of data, doing things like looking for simple patterns; maybe explore the idea of writing a baby query language that searched in RAM.

I had gotten this idea after reading the chapter in SICP about query languages.

Any thoughts on where to start? Initially, I want to ask "Give me the address space this application is running in, please" to the system.

share|improve this question
add comment

3 Answers

up vote 6 down vote accepted

You can use gdb to access the memory of a process.

Also, you should have a look at the "/proc" filesystem - it contains pseudo files for every process; some of them may contain interesting information

share|improve this answer
add comment

cat /proc/[pid]/maps according to the proc manpages.

Looks like what you want. If you need the pid, grab that from ps or whatever other tool.

That addresses finding the address space in use. One of the fellows at defcon last year implemented createremotethread on linux. So you could do that...then read arbitrary memory that way.

Credit to psusi for pointing out that pmap -x [pid] is easier to read.

share|improve this answer
3  
Note that pmap formats this information so it is more human readable. –  psusi Mar 23 '12 at 14:20
add comment

Use a debugger, that's what they're for.

If you want to roll your own, it all goes through ptrace.

You can see a process's memory map (the table of contents for the memory) in /proc/$pid/maps and read the whole memory contents from /proc/$pid/mem. You can't just open that latter file normally, see How do I read from /proc/$pid/mem under Linux?

share|improve this answer
    
+1 for the link on /proc/pid/mem –  hbdgaf Mar 24 '12 at 12:22
1  
You have been incredibly helpful with some of my questions. Do you suggest any books to read generally related to the Linux OS or particularly interesting web articles? –  James Andino May 19 '12 at 15:41
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.