Sponsored Content
Full Discussion: Memory sniffing in linux
Top Forums Programming Memory sniffing in linux Post 302276318 by mosey on Tuesday 13th of January 2009 12:47:39 PM
Old 01-13-2009
PHP Memory sniffing in linux

I am trying to create an application that will be able to sniff memory of other applications.

I am not completely new to systems programming but I am not sure how to go about this task. I understand that accomplishing this mainly require these steps.

1: Get a list of processes
2: Find the process you want to sniff.
3: Get a list of page tables assigned to that process
4: Get R / R/W access to these page tables.
5: Sniff away.

I can do 1&2 just fine, but I have no clue how to accomplish the rest.

I understand that 3 will have to do something with the process control block, and 4 will probably have to do with some system calls with high privileges.

Any advice on doing this would be appreciated, and if there are any books on this subject in particular, that would be great as well.
 

9 More Discussions You Might Find Interesting

1. IP Networking

Sniffing an established port

Hi All, On a solaris box A port B in which port B is established and receiving data. My question is how do i listen on that established port , how can i get the data received at box A: port B through my application I had searched the forum for the same, but i am unable to retrieve the... (5 Replies)
Discussion started by: matrixmadhan
5 Replies

2. Programming

memory layout in C on linux

Hi, Does any one know what tool to use to visualize how is memory layed out for C on linux systems. I mean how much stack portion is used in functional call. Where exactly does the argument to function sit in memory ? I have written small program pasted below. But I am not able to infer... (3 Replies)
Discussion started by: parasa
3 Replies

3. UNIX for Advanced & Expert Users

Memory managment - linux

Hi, I having problem with my linux machine it have 6Gb physical memory and somehow it always almost coming to the bottom neck and than it start writing to the swap memory you can see that there is more than 4G in cahce, is there any way to clean the cache or to limit it to 2Gb? host1... (6 Replies)
Discussion started by: Igal Malka
6 Replies

4. Programming

Pcap.h Sniffing

Can someone please help me figure out how to use pcap.h to sniff packets between only 2 computers whose mac addresses are know? Thanks (0 Replies)
Discussion started by: papabearcares
0 Replies

5. Shell Programming and Scripting

Pcap.h Sniffing

Can someone please help me figure out how to use pcap.h to sniff packets between only 2 computers whose mac addresses are know? Thanks (0 Replies)
Discussion started by: papabearcares
0 Replies

6. Linux

Linux Memory Track

Hi All, We are using the linux servers and need to track the memory utilization of the box. Could anyone advice how the same can be achived. :) (1 Reply)
Discussion started by: haitorajesh
1 Replies

7. What is on Your Mind?

Wired keyboard sniffing

Are we safe using the everyday wired keyboard? Although this concept is old, I had never seen an actual implementation on the matter until a few days ago. (Four ways of sniffing the electromagnetic emanations of wired keyboards currently on the market in up to 20 meters.) Check the videos at:... (2 Replies)
Discussion started by: redoubtable
2 Replies

8. Red Hat

Shared memory in linux

Hello, I am using Linux os. $ df -k /dev/shm Filesystem 1K-blocks Used Available Use% Mounted on tmpfs 2023256 1065000 958256 53% /dev/shm $ Based on my google this, it is shared memory. What is this shared memory and where exactly it is used? Can you... (5 Replies)
Discussion started by: govindts
5 Replies

9. Linux

Underutilization of Linux memory

Hi All, We are running a python application on an RHEL 7 VM machine hosted in Azure. Machine has 8GB of memory & 2GB of swap space configured as swap file. Below the output of free command from the server. #-> free -h total used free shared buff/cache ... (12 Replies)
Discussion started by: veeresh_15
12 Replies
mlock(2)							System Calls Manual							  mlock(2)

NAME
mlock() - lock a segment of the process virtual address space in memory SYNOPSIS
DESCRIPTION
The system call allows the calling process to lock a segment of the process virtual address space into memory. Any addressable segment of the process' address space may be locked. Locked segments are immune to all routine swapping. addr must be a valid address in the process virtual address space. addr + len must also be a valid address in the process virtual address space. Locks are applied at page boundaries that encompass the range from addr to addr + len. If any address within the range is not valid, an error is returned and no locks are applied. or can be used to unlock memory segments (or all memory segments) locked with Regardless of how many times a process locks a page, a single or will unlock it. An of a page within a range specified in an call results in only the range specified in the being unlocked. When memory is shared by multiple processes and mlocks are applied to the same physical page by multiple processes, a page remains locked until the last lock is removed from that page. Locks applied with are not inherited by a child process. The user must have the privilege. Although and the family of functions may be used together in an application, each may affect the other in unexpected ways. This practice is not recommended. Security Restrictions Some or all of the actions associated with this system call require the privilege. Processes owned by the superuser have this privilege. Processes owned by other users may have this privilege, depending on system configuration. See privileges(5) for more information about privileged access on systems that support fine-grained privileges. RETURN VALUE
returns the following values: Successful completion. Failure. The requested operation is not performed. is set to indicate the error. ERRORS
If fails, is set to one of the following values: One or more addresses in the specified range is not valid within the process address space. There is not enough lockable memory in the system to satisfy the locking request. The parameter was zero. The user does not have the privilege. EXAMPLES
The following call to locks the first 10 pages of the calling process in memory: SEE ALSO
setprivgrp(1M), getprivgrp(2), mlockall(2), munlock(2), munlockall(2), plock(2), privileges(5). STANDARDS CONFORMANCE
mlock(2)
All times are GMT -4. The time now is 05:50 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy