1

I have read in many tutorials that a user mode program cannot access the kernel memory and the memory of other processes.

But is this always true?

For example: couldn't the kernel map the kernel memory or the memory of some other process to the virtual address space of some process?

1

At least one prog I use takes advantage of using kernel space, netsniff-ng. Netsniff-ng is a zero-copy mechanism for capturing frames. It takes advantage by mapping the kernel space to user space. Specifically using the SOCKET_MMAP syscall. The results are fantastic. I have used to capture frames on a switch port running 2.1 Gbps with zero dropped frames.

Click here to see how the SOCKET_MMAP syscall functions and it may give you some ideas

-1

To access memory of other processes, you need capabilities that normal users do not have. However if you gain these capabilities, e.g. by becoming root, then you can do it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.