pastebin - collaborative debugging tool
kpaste.net RSS


memdump.c
Posted by Anonymous on Thu 20th Oct 2011 09:22
raw | new post

  1. /*
  2.  * Certes
  3.  *
  4.  * build avec:
  5.  *      gcc --std=c99 -W -Wall -O2 -o memdump memdump.c
  6.  *
  7.  * utiliser avec:
  8.  *      - Trouver adresse de la section intéressante avec /proc/<pid>/maps
  9.  *      - memdump <pid> <adresse> <nombres de bytes> | hexdump -C (ou > dump)...
  10.  */  
  11. #define _LARGEFILE64_SOURCE
  12. #include <stdio.h>
  13. #include <stdlib.h>
  14. #include <stdint.h>
  15. #include <sys/ptrace.h>
  16. #include <sys/stat.h>
  17. #include <sys/types.h>
  18. #include <unistd.h>
  19. #include <sys/wait.h>
  20. #include <fcntl.h>
  21.  
  22. int main(int argc, char *argv[])
  23. {
  24.     long long int adr = 0;
  25.     int32_t size = 0;
  26.     int32_t pid  = 0;
  27.     uint8_t byte = 0;
  28. //    uint32_t word = 0;
  29.     char buffer[64];
  30.     char *endptr;
  31.     int fd;
  32.  
  33.     if(argc != 4)
  34.     {
  35.         fprintf(stderr, "Usage %s <pid> <address> <size>\n", argv[0]);
  36.         exit(1);
  37.     }
  38.  
  39.     pid  = atoi(argv[1]);
  40.     adr  = strtoll(argv[2], &endptr, 16);
  41.     size = atoi(argv[3]);
  42.  
  43.     if(adr)
  44.     {
  45.         ptrace(PTRACE_ATTACH, pid, NULL, NULL);
  46.         waitpid(pid, NULL, 0);
  47.         sprintf(buffer, "/proc/%i/mem", pid);
  48.         if((fd = open(buffer, O_RDONLY)) > 0)
  49.         {
  50.             printf("Reading %i byte(s) from %016llX\n", size, adr);
  51.             lseek64(fd, adr, SEEK_SET);
  52.             for(int i = 0; i < size; ++i)
  53.             {
  54. //                if(read(fd, (void *)&word, sizeof(uint32_t)) > 0)
  55.                 if(read(fd, (void *)&byte, sizeof(uint8_t)) > 0)
  56.                 {
  57.                     printf("%c", byte);
  58.                     /*
  59.                      * Traitement par word (de 32 bits) affichés par char (de 8 bits)
  60.                     endptr = (char *)&word;
  61.                     for(int j = sizeof(uint32_t); j; --j, endptr++)
  62.                     {
  63.                         printf("%c", *endptr);
  64.                     }
  65.                     printf("'\n");*/
  66.                 }
  67.             }
  68.             printf("\n");
  69.             close(fd);
  70.         }
  71.         ptrace(PTRACE_DETACH, pid, NULL, NULL);
  72.     }
  73.     return 0;
  74. }

Submit a correction or amendment below (click here to make a fresh posting)
After submitting an amendment, you'll be able to view the differences between the old and new posts easily.

Syntax highlighting:

To highlight particular lines, prefix each line with {%HIGHLIGHT}




All content is user-submitted.
The administrators of this site (kpaste.net) are not responsible for their content.
Abuse reports should be emailed to us at