At the memory address, 0x7fffffffeb58
of a program lies a value, I want to find out the value of the address.
Is there a way to get the value just by using commands?
I've tried dd
but to no avail.
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.
Sign up to join this communityAt the memory address, 0x7fffffffeb58
of a program lies a value, I want to find out the value of the address.
Is there a way to get the value just by using commands?
I've tried dd
but to no avail.
To peek at memory addresses of a process, you can look at /proc/$pid/mem
. See also /proc/$pid/maps
for what's mapped in the process' address space.
You'll want to seek()
within that file to the location you want, which you should be able to do with dd
:
dd bs=1 skip="$((0x7fffffffeb58))" count=4 if="/proc/$pid/mem" |
od -An -vtu4
Would read 4 bytes at that address and interpret them as an unsigned 32 bit integer.
Another approach is to attach a debugger to the process:
gdb --batch -ex 'x/u 0x7fffffffeb58' -p "$pid"
In any case, note that depending on the value of the kernel.yama.ptrace_scope
sysctl, you may need to have superuser privileges to do that.
cgcreate -g memory
to create a cgroup, cgexec --sticky
to start the process in the cgroup created, and cat /path/to/cgroup/cgroup.procs
to get pids.
killall -STOP process_name
) which would give you all the time you need to look at their memory.
Dec 17, 2018 at 17:22
If you want to access virtual memory of a specific process: refer to @Stéphane's answer.
If you want to access physical memory:
If you have devmem
installed:
devmem 0x2000000
Alternative approach with hexdump:
hexdump -C --skip 0x7fffffffeb58 /dev/mem | head
See this question on StackOverflow.
/dev/mem
. The OP likely meant a virtual address ("of a program" suggests this, though he didn't specify exactly).