At the memory address, 0x7fffffffeb58 of a program lies a value, I want to find out the value of the address.
Is there a way to get the value just by using commands?
I've tried dd but to no avail.
-
Can you give more context as to what you're trying to do?– Stéphane ChazelasDec 17, 2018 at 14:40
-
I am doing a CTF challenge and the hint tells me that i have to find a way to read a memory address (0x7fffffffeb58) of a ELF file/program and it will give me the value of an unsigned int.– fdfdfdDec 17, 2018 at 14:52
Add a comment
|
2 Answers
To peek at memory addresses of a process, you can look at /proc/$pid/mem. See also /proc/$pid/maps for what's mapped in the process' address space.
You'll want to seek() within that file to the location you want, which you should be able to do with dd:
dd bs=1 skip="$((0x7fffffffeb58))" count=4 if="/proc/$pid/mem" |
od -An -vtu4
Would read 4 bytes at that address and interpret them as an unsigned 32 bit integer.
Another approach is to attach a debugger to the process:
gdb --batch -ex 'x/u 0x7fffffffeb58' -p "$pid"
In any case, note that depending on the value of the kernel.yama.ptrace_scope sysctl, you may need to have superuser privileges to do that.
answered Dec 16, 2018 at 15:31
-
I tried to find the pid of my program using px ax but i found out that the process ID kept on changing and it is not inside proc/ folder. Am i doing something wrong here?– fdfdfdDec 17, 2018 at 14:09
-
@suppko you could try containing your process inside a cgroup, and then just access the pid in the cgroup
cgcreate -g memoryto create a cgroup,cgexec --stickyto start the process in the cgroup created, andcat /path/to/cgroup/cgroup.procsto get pids.– Dani_lDec 17, 2018 at 15:08 -
@suppko, you could start by suspending those processes (
killall -STOP process_name) which would give you all the time you need to look at their memory. Dec 17, 2018 at 17:22
If you want to access virtual memory of a specific process: refer to @Stéphane's answer.
If you want to access physical memory:
If you have devmem installed:
devmem 0x2000000
Alternative approach with hexdump:
hexdump -C --skip 0x7fffffffeb58 /dev/mem | head
See this question on StackOverflow.
-
3Note that there's a difference between virtual memory addresses which belong to a certain process, and physical memory addresses which you can access via
/dev/mem. The OP likely meant a virtual address ("of a program" suggests this, though he didn't specify exactly).– dirktDec 17, 2018 at 9:15 -