1

At the memory address, 0x7fffffffeb58 of a program lies a value, I want to find out the value of the address.

Is there a way to get the value just by using commands?

I've tried dd but to no avail.

  • Can you give more context as to what you're trying to do? – Stéphane Chazelas Dec 17 '18 at 14:40
  • I am doing a CTF challenge and the hint tells me that i have to find a way to read a memory address (0x7fffffffeb58) of a ELF file/program and it will give me the value of an unsigned int. – suppko Dec 17 '18 at 14:52
4

To peek at memory addresses of a process, you can look at /proc/$pid/mem. See also /proc/$pid/maps for what's mapped in the process' address space.

You'll want to seek() within that file to the location you want, which you should be able to do with dd:

dd bs=1 skip="$((0x7fffffffeb58))" count=4 if="/proc/$pid/mem" |
  od -An -vtu4

Would read 4 bytes at that address and interpret them as an unsigned 32 bit integer.

Another approach is to attach a debugger to the process:

gdb --batch -ex 'x/u 0x7fffffffeb58' -p "$pid"

In any case, note that depending on the value of the kernel.yama.ptrace_scope sysctl, you may need to have superuser privileges to do that.

  • I tried to find the pid of my program using px ax but i found out that the process ID kept on changing and it is not inside proc/ folder. Am i doing something wrong here? – suppko Dec 17 '18 at 14:09
  • @suppko you could try containing your process inside a cgroup, and then just access the pid in the cgroup cgcreate -g memory to create a cgroup, cgexec --sticky to start the process in the cgroup created, and cat /path/to/cgroup/cgroup.procs to get pids. – Dani_l Dec 17 '18 at 15:08
  • @suppko, you could start by suspending those processes (killall -STOP process_name) which would give you all the time you need to look at their memory. – Stéphane Chazelas Dec 17 '18 at 17:22
3

If you want to access virtual memory of a specific process: refer to @Stéphane's answer.

If you want to access physical memory:

If you have devmem installed:

devmem 0x2000000 

Alternative approach with hexdump:

hexdump -C --skip 0x7fffffffeb58 /dev/mem | head

See this question on StackOverflow.

  • 2
    Note that there's a difference between virtual memory addresses which belong to a certain process, and physical memory addresses which you can access via /dev/mem. The OP likely meant a virtual address ("of a program" suggests this, though he didn't specify exactly). – dirkt Dec 17 '18 at 9:15
  • I think you are right. I've added some explanation. – rudib Dec 17 '18 at 12:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.