Reading /proc/<pid>/mem

magnus.therning · 07-10-2006, 10:50 AM

I'm having some problems with reading /proc/<pid>/mem

What I'm doing is the following:

1. attach to another process using ptrace (it's paused automatically doing this)
2. read that processes' memory map (/proc/<pid>/maps)
3. do a pread() on each "segment" in the map

I've verified that the ptrace attaching works, the process is paused as expected.

The problem is reading the data, and I have two problems:

It seems I'm reading nothing but zeros.
I can read the three first segments just fine:
8048000 - 80bb000
80bb000 - 80be000
80be000 - 8179000
but when I hit the next one:
a7a63000 - a7a81000
I get an "Invalid argument" from pread. I'm guessing it's the offset that's invalid since all the other arguments are unchanged from previous calls.

Any suggestions?

magnus.therning · 07-10-2006, 12:02 PM

Quote:

Originally Posted by magnus.therning

I'm having some problems with reading /proc/<pid>/mem

What I'm doing is the following:

1. attach to another process using ptrace (it's paused automatically doing this)
2. read that processes' memory map (/proc/<pid>/maps)
3. do a pread() on each "segment" in the map

I've verified that the ptrace attaching works, the process is paused as expected.

The problem is reading the data, and I have two problems:

It seems I'm reading nothing but zeros.
I can read the three first segments just fine:
8048000 - 80bb000
80bb000 - 80be000
80be000 - 8179000
but when I hit the next one:
a7a63000 - a7a81000
I get an "Invalid argument" from pread. I'm guessing it's the offset that's invalid since all the other arguments are unchanged from previous calls.

Any suggestions?

After some more testing it seems that the pread doesn't handle seeking to offsets large enough to read /proc/<pid>/mem. I've tried passing -D_FILE_OFFSET_BITS=64 on the command line when compiling, but that didn't seem to do it (I stuck an lseek in there as well just to make sure and it behaves exactly like pread).

Hmmm, am I missing something here?

magnus.therning · 07-16-2006, 08:29 AM

Quote:

Originally Posted by magnus.therning

After some more testing it seems that the pread doesn't handle seeking to offsets large enough to read /proc/<pid>/mem. I've tried passing -D_FILE_OFFSET_BITS=64 on the command line when compiling, but that didn't seem to do it (I stuck an lseek in there as well just to make sure and it behaves exactly like pread).

Hmmm, am I missing something here?

The problem is solved and I thought that for completeness I should write something on LinuxQuestions... even though I never managed to get anyone interested enough in my problem

Following the lseek64(3) man page I stuck the following at the top of the source to turn on 64 bit file offsets:

Code:

#define _FILE_OFFSET_BITS 64

What I had failed to do was to include unistd.h. It didn't result in any compiler or linker problems, so it took me some time to figure out. Once I had stuck the following in my source it all worked fine

Code:

#define _XOPEN_SOURCE 500
#include <unistd.h>