CODEWITHSUNDEEP
linuxbashmemory
theasker228
theasker228

Reputation: 183

How to get value at a memory address in linux shell

I know that we can get the value at a memory address through a C program or gdb.

Is there any way to get it by bash shell or something like "one-line" perl instruction?

Upvotes: 5

Views: 5963

Answers (3)

Philip Couling
Philip Couling

Reputation: 14924

Short answer... No

If you were very careful it MIGHT be possible to pass instructions into GDB and interpret the output. Look at rocky's answer if you want to try.

Its part of the unix process model that one process cannot see inside another and cannot read each other's memory. This is for security. There is a special kernal API which can be used to see into programs. But there are very few clients for this API. Off the top of my head GDB is the only one I know.

I suspect that what you're trying to achieve is either a really bad idea or can be done without reading a program's memory.

Upvotes: 2

rocky
rocky

Reputation: 7098

The following possibly gets close to what you may want. And if not, hopefully you'll be able to adapt.

I'll say at the outset though that you are extremely vague at what you mean by "memory address". Below I am going to take that to mean the address of the current instruction executed which I will use the gdb command "backtrace" to get. Adapt the gdb command from "bt" to whatever it is you were thinking of to get the "memory address".

Let's say your program is sleeper-for-pid with process id 3963

 sudo gdb --ex 'bt 1' --batch -nx -p 3963

will run gdb attached to the process and give a backtrace of the most recent entry. Here is an example: 

sudo gdb --ex 'bt 1' --batch -nx -p 3963
84  ../sysdeps/unix/syscall-template.S: No such file or directory.
(gdb) #0  0x00007f5dee71f2f0 in __nanosleep_nocancel () at ../sysdeps/unix/syscall-template.S:84

If you really just want the line with the address, you'd grep for #0, e.g.

sudo gdb --ex 'bt 1' --batch -nx -p 3963 | grep '#0'
(gdb) #0  0x00007f5dee71f2f0 in __nanosleep_nocancel () at ../sysdeps/unix/syscall-template.S:84

And if you just want the address you might have to do a further cut, e.g.

$ sudo gdb --ex 'bt 1' -nx -p 3963| grep '#0' | cut -d' ' -f 4
0x00007f5dee71f2f0

If you don't know the process id, you might be able to use pidof. For example if the command name is sleeper-for-pid:

$ sudo gdb --ex 'bt 1' --batch -nx -p $(pidof sleeper-for-pid)

And "sudo" may or may not work for you or be needed.

Personally, instead of just the most recent backtrace entry I prefer more than that. So bt 1 might get adjusted to bt 3 or bt for a more full back trace.

Hopefully this is enough to get you started .

Upvotes: 1

user3344003
user3344003

Reputation: 21647

I know that we can get the value at a memory address through a C program or gdb Are there any way to get it by bash shell or something like "one-line" perl instruction??

A shell is just a program. What you asking to do is rather meaningless. Assuming a shell did allow you to inspect a memory address (and you could easily modify a shell or write your own to do so), The value of a memory address is for the shell's process. Any other process is going to have a different memory value at the same address.

Upvotes: 0

Related Questions