0

I want to see the contents of a program being stored in RAM when the program is executed . I have used cat /proc/[pid]/meminfo but it gave only address and permission mode details . I also tried pmaps -X pid , it gave too many details but the data . How to see the content loaded on RAM ?

3

/proc/[pid]/mem lets you access the virtual memory of a process.

Offsets in that file correspond to virtual addresses. /proc/[pid]/maps tells you which address ranges are backed by actual memory (and where the memory itself is backed by files).

All this is documented in the proc(5) manpage.

A process can only access the memory of processes which are run under the same user as itself, and which are not setgid/uid. It used to be the case that you had to ptrace() a process in order to access its memory via /proc/[pid]/mem, but this is no longer true since quite a while.

Practical example

In a terminal window:

% echo $$ # show our pid
6744
% read -sp 'secret pasword: '; echo
secret pasword:
%

Then in another terminal window:

% grep heap /proc/6744/maps
01bb7000-01c3e000 rw-p 00000000 00:00 0                                  [heap]
% dd if=/proc/6744/mem bs=1 skip=$((0x01bb7000)) count=$((0x01c3e000-0x01bb7000)) status=none |
    strings | less
...
% dd if=/proc/6744/mem bs=1 skip=$((0x01bb7000)) count=$((0x01c3e000-0x01bb7000)) status=none |
    strings | grep qwerty
qwertyuiop # here is the "secret password"

People generally use a debugger like gdb to peek at the memory of a running process instead of rudimentary ways like this (a debugger knows the format of the structures used by a process, can follow pointers, lists, etc), but the principle is basically the same.

Recent linux kernels also have nicer interfaces instead of /proc/[pid]/mem, like process_vm_readv. Just as with /proc/[pid]/mem or PTRACE_PEEK, etc. you need root-like privileges (CAP_SYS_PTRACE) in order to read the memory of a process you don't own.

  • I guess you didn't bother to read my answer. I've added an example, maybe this makes things more clear. – pizdelect May 12 at 7:18
  • Thanks for clearing my doubt , first time when I read the example was not loaded in my phone , just now I saw it my laptop , sry for my early comment and thanks a lot for the help!! – adari.girishkumar May 12 at 12:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.