0

Is it possible to read virtual memory even if /dev/kmem is not available? I know that I can recompile kernel to allow this file, but that's not the solution I'm looking for. Is there some tricky way I can read it sequentially e.g. from LKM? Are there some system calls which will give me direct access to virtual memory?

2
  • Are you after the kernel memory? Or process memory? Or memory allocated to hardware devices? Or the physical RAM? – Gilles 'SO- stop being evil' Feb 27 '12 at 23:05
  • @Gilles Yes, I want to access kernel memory, I need the exact output which gives me /dev/kmem. My goal is to search through memory, find function calls and insert kprobes on their addresses. – Peter Krejci Feb 28 '12 at 10:15
1

/dev/kmem is removed on most distribution because it is a tremendous security risk without any clearcut benign uses (yes, what you want to do according to the comment is violate the kernel's security). Perhaps some of the tracing packages give you what you need? System tap comes to mind...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.