CODEWITHSUNDEEP
elf
Bob5421
Bob5421

Reputation: 9173

ELF read/write in other process memory

Is there an equivalent of ReadProcessMemory windows function for reading (or writing) in another process memory ? I have tried to preload a shared library, i have also tried to debug (ptrace, peek and poke memory). It seems to work, but i am wondering if there is not a simplest way...

Upvotes: 0

Views: 458

Answers (1)

Employed Russian
Employed Russian

Reputation: 213957

Is there an equivalent of ReadProcessMemory

Yes: man ptrace (PTRACE_PEEKDATA, etc.)

The ptrace interface is generic to UNIX, and has nothing to do with ELF (i.e. it also works on systems that use COFF, or AOUT as their normal executable format).

Is this this simplest way?

It's the only way on most UNIX platforms.

On Linux, you could also read/write /proc/$pid/mem. Note however, that many kernels disable this for security reasons (having this file read/writable presents a huge security attack surface).

On Solaris, there has been a different /proc interface, but (as far as I can tell) it has not been adopted on any other system.

Upvotes: 1

Related Questions