Searching a process' memory on Linux

Question

How can I search the memory state of an process in Linux? Specifically I wish to identify certain regions of interest, and peek at them at regular intervals, possibly occasionally poking new values.

I suspect an answer may involve calls to ptrace(), and reading /proc/[pid]/mem, but need more to go on.

Answer 1

I've developed some code for the requested functionality.

The module memutil provides process memory region iteration, and python or C memory reading with assistance from the ptrace module, and readmem executable.

If there is any questions, or requests for standalone tools, just ask.

Answer 2

Perhaps using GDB would be an option? You should be able to do things like periodically reading memory using breakpoints.

Answer 3

I believe you can achieve what you want by parsing /proc/[pid]/maps -- I've used that to diagnose invalid pointers