Login or Register to Ask a Question and Join Our Community

Sponsored Content
Full Discussion: Memory sniffing in linux
Top Forums Programming Memory sniffing in linux Post 302276378 by Corona688 on Tuesday 13th of January 2009 02:13:50 PM
Old 01-13-2009
/proc/n/maps shows what segments are mapped into a process' memory:

Code:
$ cat /proc/$$/maps
08048000-080e3000 r-xp 00000000 03:02 737092     /bin/bash
080e3000-080e8000 rw-p 0009a000 03:02 737092     /bin/bash
080e8000-0810e000 rw-p 080e8000 00:00 0          [heap]
b7d7f000-b7dc0000 rw-p b7d7f000 00:00 0
b7dc0000-b7dc8000 r-xp 00000000 03:02 610050     /lib/libnss_files-2.4.so
b7dc8000-b7dca000 rw-p 00007000 03:02 610050     /lib/libnss_files-2.4.so
b7dca000-b7dd2000 r-xp 00000000 03:02 610082     /lib/libnss_nis-2.4.so
b7dd2000-b7dd4000 rw-p 00007000 03:02 610082     /lib/libnss_nis-2.4.so
b7dd4000-b7de5000 r-xp 00000000 03:02 610079     /lib/libnsl-2.4.so
b7de5000-b7de7000 rw-p 00010000 03:02 610079     /lib/libnsl-2.4.so
b7de7000-b7de9000 rw-p b7de7000 00:00 0
b7de9000-b7def000 r-xp 00000000 03:02 610084     /lib/libnss_compat-2.4.so
b7def000-b7df1000 rw-p 00005000 03:02 610084     /lib/libnss_compat-2.4.so
b7df1000-b7df2000 rw-p b7df1000 00:00 0
b7df2000-b7f09000 r-xp 00000000 03:02 610107     /lib/libc-2.4.so
b7f09000-b7f0b000 r--p 00116000 03:02 610107     /lib/libc-2.4.so
b7f0b000-b7f0d000 rw-p 00118000 03:02 610107     /lib/libc-2.4.so
b7f0d000-b7f10000 rw-p b7f0d000 00:00 0
b7f10000-b7f12000 r-xp 00000000 03:02 609797     /lib/libdl-2.4.so
b7f12000-b7f14000 rw-p 00001000 03:02 609797     /lib/libdl-2.4.so
b7f14000-b7f4d000 r-xp 00000000 03:02 962933     /lib/libncurses.so.5.6
b7f4d000-b7f56000 rw-p 00038000 03:02 962933     /lib/libncurses.so.5.6
b7f56000-b7f57000 rw-p b7f56000 00:00 0
b7f62000-b7f64000 rw-p b7f62000 00:00 0
b7f64000-b7f65000 r-xp b7f64000 00:00 0          [vdso]
b7f65000-b7f7f000 r-xp 00000000 03:02 609869     /lib/ld-2.4.so
b7f7f000-b7f80000 r--p 00019000 03:02 609869     /lib/ld-2.4.so
b7f80000-b7f81000 rw-p 0001a000 03:02 609869     /lib/ld-2.4.so
bf939000-bf94f000 rw-p bf939000 00:00 0          [stack]

The bolded segments contain live data, while the rest are shared libraries or kernel things.

/proc/n/mem allows arbitrary access to a process' virtual memory space, but only for the root user.
 

9 More Discussions You Might Find Interesting

1. IP Networking

Sniffing an established port

Hi All, On a solaris box A port B in which port B is established and receiving data. My question is how do i listen on that established port , how can i get the data received at box A: port B through my application I had searched the forum for the same, but i am unable to retrieve the... (5 Replies)
Discussion started by: matrixmadhan
5 Replies

2. Programming

memory layout in C on linux

Hi, Does any one know what tool to use to visualize how is memory layed out for C on linux systems. I mean how much stack portion is used in functional call. Where exactly does the argument to function sit in memory ? I have written small program pasted below. But I am not able to infer... (3 Replies)
Discussion started by: parasa
3 Replies

3. UNIX for Advanced & Expert Users

Memory managment - linux

Hi, I having problem with my linux machine it have 6Gb physical memory and somehow it always almost coming to the bottom neck and than it start writing to the swap memory you can see that there is more than 4G in cahce, is there any way to clean the cache or to limit it to 2Gb? host1... (6 Replies)
Discussion started by: Igal Malka
6 Replies

4. Programming

Pcap.h Sniffing

Can someone please help me figure out how to use pcap.h to sniff packets between only 2 computers whose mac addresses are know? Thanks (0 Replies)
Discussion started by: papabearcares
0 Replies

5. Shell Programming and Scripting

Pcap.h Sniffing

Can someone please help me figure out how to use pcap.h to sniff packets between only 2 computers whose mac addresses are know? Thanks (0 Replies)
Discussion started by: papabearcares
0 Replies

6. Linux

Linux Memory Track

Hi All, We are using the linux servers and need to track the memory utilization of the box. Could anyone advice how the same can be achived. :) (1 Reply)
Discussion started by: haitorajesh
1 Replies

7. What is on Your Mind?

Wired keyboard sniffing

Are we safe using the everyday wired keyboard? Although this concept is old, I had never seen an actual implementation on the matter until a few days ago. (Four ways of sniffing the electromagnetic emanations of wired keyboards currently on the market in up to 20 meters.) Check the videos at:... (2 Replies)
Discussion started by: redoubtable
2 Replies

8. Red Hat

Shared memory in linux

Hello, I am using Linux os. $ df -k /dev/shm Filesystem 1K-blocks Used Available Use% Mounted on tmpfs 2023256 1065000 958256 53% /dev/shm $ Based on my google this, it is shared memory. What is this shared memory and where exactly it is used? Can you... (5 Replies)
Discussion started by: govindts
5 Replies

9. Linux

Underutilization of Linux memory

Hi All, We are running a python application on an RHEL 7 VM machine hosted in Azure. Machine has 8GB of memory & 2GB of swap space configured as swap file. Below the output of free command from the server. #-> free -h total used free shared buff/cache ... (12 Replies)
Discussion started by: veeresh_15
12 Replies

LEARN ABOUT FREEBSD

tdfx_linux

TDFX(4) 						   BSD Kernel Interfaces Manual 						   TDFX(4)

NAME

     tdfx -- Voodoo Graphics and VoodooII Memory Access GLIDE device driver

SYNOPSIS

     device tdfx
     device tdfx_linux

DESCRIPTION

     This driver creates an entry in /dev that allows programs (mostly GLIDE-based software) to access the device memory of the Voodoo Graphics
     and VoodooII 3D accelerators created by 3Dfx, Inc.  This provides an interface for applications based on the GLIDE API or that simply use the
     API provided by the linux /dev/3dfx device to use the video device.

     Supports all cards based on the following chipsets:

	   3Dfx Voodoo Graphics
	   3Dfx Voodoo II

     Specifically, the following cards should work:

	   Diamond Multimedia Monster 3D
	   Diamond Multimedia Monster 3D II

     Note that this driver does not currently have support for the Voodoo Banshee, Voodoo3, Voodoo5, or Voodoo6 based cards.  It also does not
     currently support the Voodoo Rush.  It also does not yet handle the SLI feature of the Voodoo II boards.  You can only use each of them sepa-
     rately.

     By including tdfx_linux, you can enable the linux ioctl code for this driver, where the only supported applications currently reside.

FILES

     /dev/3dfx	   Symlinked to default 3dfx board
     /dev/3dfx*    Character Device programming interface

     /dev/voodoo   Mirrors of above interfaces
     /dev/voodoo*  (Some apps use /dev/voodoo)

HISTORY

     The tdfx driver appeared in FreeBSD 5.0, and was originally developed for Linux kernel 2.0.x, later written for 2.2.x and 2.4.x.

AUTHORS

     The driver was developed by Coleman Kane <cokane@micro.ti.com> after the linux version of this driver by Darryll Straus, John Taylor, Jens
     Axboe, Carlo Wood <carlo@alinoe.com> and Joseph Kain <joseph@3dfx.com> to be directly compatible with it and support the many GLIDE based
     games available for Linux and UNIX.

BSD
								 February 19, 2001							       BSD
All times are GMT -4. The time now is 10:52 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy