Member Avatar for Eddy Dean

Hello,

I want to be able to read the memory of a process in Linux. After some googling I've read that ptrace can be used to this. The syntax of ptrace is as follows:

int ptrace(int request, pid_t pid, int addr, int data);

The first value (int request) is what function ptrace should use. For reading memory this should be PTRACE_PEEKDATA .
That won't be a problem... int data won't be a problem either. But then there is pid (process id). How am I supposed to find the process ID? Of course I do know the name and the filename of the program. The other problem is the int addr. In windows there were several tools to find this (TSearch, ArtMoney), but I don't know any of these tools for Linux (using ubuntu).

I hope some of you know a bit more about these parameters. I've done this before in Windows, and the DaniWeb community really helped me a lot back then, let's see if they can do the same for Linux ;)

Thanks in advance,
Arno

  • 2 Contributors
  • 3 Replies
  • 357 Views
  • 6 Hours Discussion Span
  • Latest Post Latest Post by ~s.o.s~

Dani AI

Generated

Brief, practical follow-up to using the pointers posted. The task breaks down into three concrete steps: find the target PID, resolve the runtime address you actually want to read, then attach/read (with the right permissions). The notes below give commands and a short troubleshooting checklist you can apply immediately.

Find the PID

pgrep -f <program-name>
pidof <program-name>
ps aux | grep -F <program-name> | awk '{print $2}'

You can also inspect /proc (each numeric directory is a PID) or use lsof -p <pid> to confirm which instance opened the file you care about.

Find the runtime address
Read /proc/<pid>/maps (or pmap -x <pid>) to see mapping start–end addresses and which file is mapped where. Use nm, readelf -s or objdump -T on the executable or shared object to get a symbol’s offset, then add the mapping base from /proc/<pid>/maps to compute the runtime address. ASLR will randomize bases, so always get the maps from the running process rather than assuming compile-time addresses.

Attach/read and common pitfalls
Attach with a debugger or ptrace (this will stop the target), then read memory either with the ptrace read calls or by reading /proc/<pid>/mem while the process is stopped. Detach when finished so the program resumes. Permissions matter: you must be the same user or root, and many distributions enforce ptrace restrictions (check /proc/sys/kernel/yama/ptrace_scope). Typical failures are trying to read an address not inside any mapping, attaching when the process is already traced, or using symbol offsets without adding the actual mapping base — double-check /proc/<pid>/maps if results look wrong. For quick verification use gdb -p <pid> to inspect mappings and memory before coding an automated reader.

Recommended Answers

All 3 Replies

Member Avatar for Eddy Dean

The second link was really helpful, I did not find that one yet.

Now I should be able to read to an different process, but there are just two problems left. How do I get the pid, how do I get the address. Getting the pid is done with parameters in all examples I've seen (including your links).

Thanks,
Arno

Member Avatar for ~s.o.s~

For getting the address of a process in linux see here

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.