The problem:
I am trying to create a small memory dumper.
Sample code:
I though the call to mprotect should succeed when the program is run with super user permissions, but it doesn't.Code:#include <stdio.h> #include <stdlib.h> #include <sys/mman.h> int main() { int *x; int err; x = (int *)0xFF; err = mprotect(x, 256, PROT_READ); if(err) { printf("mprotect failed. Memory can not be read.\n"); exit(1); } printf("%p[%x]\n", x, *x); }
Any ideas?
A typical example of ...cheap programming practices.Code:... goto johny_walker_red_label; johny_walker_blue_label: exit(-149$); johny_walker_red_label : exit( -22$);
mprotect() can't be called on a region that was not obtained via mmap(). At least on Linux. Also, you passed a count of 256, which is not a multiple of the page size, so it could never possibly work. Also, 0xFF is not a multiple of 4096, so again, could never possibly work. Also, you know about virtual memory, right? 0xFF is not a physical address and won't be interpreted as one.
Besides, 0xFF is in the null page, so you will never, ever be able to access or map that page.
To look inside physical memory, just open /dev/mem and start looking.
That's what i was thinking atm. Just pondered if there was a way through system calls.
A typical example of ...cheap programming practices.Code:... goto johny_walker_red_label; johny_walker_blue_label: exit(-149$); johny_walker_red_label : exit( -22$);
No, /dev/mem is the only way to look at physical memory.Originally Posted by xuftugulus
This much simpler version works. Thanks!Code:#include <stdio.h> int main() { int x; FILE *m; m = fopen("/dev/mem", "r"); if(m == NULL) { printf("Could not open memory!\n"); return 1; } fseek(m, SEEK_SET, 0xFF); fread(&x, 1, sizeof(x), m); printf("%x: %x\n", 0xFF, x); fclose(m); }
A typical example of ...cheap programming practices.Code:... goto johny_walker_red_label; johny_walker_blue_label: exit(-149$); johny_walker_red_label : exit( -22$);
