Tag Info

New answers tagged

2

In order to read /proc/[pid]/mem, a process must now PTRACE_ATTACH to it. A commonly available utility that does this is gdb Pick a running process (in my case I just opened cat in another window), then attach gdb to that process: [root@qemu ~]# gdb --pid 423 #MORE OUTPUT 0xb771dbac in __kernel_vsyscall () As part of its output while loading symbols, gdb ...


4

As it so happens, there is another significant interface with the kernel: the /proc and /sys virtual filesystems. While they do not hold regular files, their contents are direct gateways to the kernel: to act on them is to act directly on kernel-allocated memory. For instance, if you want to drop all memory caches, you may use... echo 3 > ...


1

It depends. What do you mean by 'verify'? If you just want to monitor what syscalls some process is triggering then it's possible.. usually.... But if you feel like digging deeper then you're in trouble... I have not heard of any tools that could do that. You can use strace to see what syscalls some particular process is firing. Of course you'll have to ...


4

I will try to answer questions as briefly as possible. The questions you are asking are usually addressed in introductory operating systems courses at universities but I will assume you have not taken such a course. Memory isolation for userspace processes is very desirable - not only to protect the kernel from malicious userspace programs, but also to ...



Top 50 recent answers are included