Reading proc/pid/mem File

[sternr]

(Figured it deserves a different thread).

I'm trying to read a different process's proc/pid/mem file given I know it's pid.
here's my code:
===START
string fn = "/proc/pid/mem"; //where pid is the right pid
int fd = open(fn.c_str(), O_RDONLY);
char* buff = new char[BUFF_SIZE];
int size = read(fd, buff, BUFF_SIZE);
===END
No matter what BUFF_SIZE is, or whether I use lseek before (to change the cursur to a specific location), read always returns -1.

I tried running the process with sudo but still no success.

Any ideas?

Thanks!

--sternr

[Richard Kettlewell]

sternr <ste...@gmail.com> writes:

> (Figured it deserves a different thread).
>
> I'm trying to read a different process's proc/pid/mem file given I know it's pid.
> here's my code:
> ===START
> string fn = "/proc/pid/mem"; //where pid is the right pid
> int fd = open(fn.c_str(), O_RDONLY);

You should check whether the open() succeeds.

> char* buff = new char[BUFF_SIZE];
> int size = read(fd, buff, BUFF_SIZE);
> ===END
> No matter what BUFF_SIZE is, or whether I use lseek before (to change
> the cursur to a specific location), read always returns -1.
>
> I tried running the process with sudo but still no success.
>
> Any ideas?

See what value errno is set to.

--
http://www.greenend.org.uk/rjk/

[sternr]

The open call goes with errno = 0.
The read, returns with errno = 3 which suppose to mean "NO Process found"
But the process is still in the air, and anyway the open succeeded so how can that be? or is it not the right errno description?

[Jorgen Grahn]

On Sun, 2011-02-06, sternr wrote:

Please quote some context.

You should check the return code from open(2), and only check errno if
it returned -1. See the man page. You should also feed the errno to
strerror() or perror() to find out what it means, rather than guess at
the meaning of 0 and 3.

Or, if it's just for a quick test and you're too lazy to write all the
error handling code[1], you can run the program under strace
which will show exactly how the calls failed.

I have the feeling you're misinterpreting what's happening.

/Jorgen

[1] No offense intended; sometimes it makes sense to be lazy.

--
// Jorgen Grahn <grahn@ Oo o. . .
\X/ snipabacken.se> O o .

[Richard Kettlewell]

sternr <ste...@gmail.com> writes:

Having looked into it a bit further, you're not allowed to read memory
belonging to other processes (apart from an exception involving ptrace).

Getting ESRCH instead of EPERM may be a bug. See fs/proc/base.c, in
particular mem_read() and check_mem_permission().

--
http://www.greenend.org.uk/rjk/

[sternr]

Here's the updated test program followed by the output:

=====Start Code
string fn = "/proc/pid/mem";

int fd = open(fn.c_str(), O_RDONLY);

perror("open status");
char* buf = new char[100];
int count = read(fd,buf,10);
perror("read status");
=====Start Output:
open status: Success
read status: No such process
=====End

(This is example code only, obviously my final program will not look like it...)
Any ideas?

[sternr]

I was afraid you'd say that.

So I can only read the memory of a self or a child process?

Thanks again for the help!

[sternr]

Found this on Google:

http://unix.stackexchange.com/questions/6301/how-do-i-read-from-proc-pid-mem-under-linux/6302#6302

FYI