Low-overhead way to access the memory space of a traced process?
Posted
by vovick
on Stack Overflow
See other posts from Stack Overflow
or by vovick
Published on 2009-06-05T22:05:43Z
Indexed on
2010/03/26
21:53 UTC
Read the original article
Hit count: 149
Hello all.
I'm looking for an efficient way to access(for both read and write operations) the memory space of my ptraced child process. The size of blocks being accessed may vary from several bytes up to several megabytes in size, so using the ptrace call with PTRACE_PEEKDATA
and PTRACE_POKEDATA
which read only one word at a time and switch context every time they're called seems like a pointless waste of resources. The only one alternative solution I could find, though, was the /proc/<pid>/mem
file, but it has long since been made read only.
Is there any other (relatively simple) way to do that job? The ideal solution would be to somehow share the address space of my child process with its parent and then use the simple memcpy call to copy data I need in both directions, but I have no clues how to do it and where to begin.
Any ideas?
© Stack Overflow or respective owner