How to get value of a memory address using command?
At the memory address, 0x7fffffffeb58 of a program lies a value, I want to find out the value of the address.
Is there a way to get the value just by using commands?
I've tried dd but to no avail.
linux command-line memory command dd
edited Dec 16 at 14:43
rudib
620417
asked Dec 16 at 12:55
suppko
63
add a comment |
At the memory address, 0x7fffffffeb58 of a program lies a value, I want to find out the value of the address.
Is there a way to get the value just by using commands?
I've tried dd but to no avail.
linux command-line memory command dd
edited Dec 16 at 14:43
rudib
620417
asked Dec 16 at 12:55
suppko
63
Can you give more context as to what you're trying to do?
– Stéphane Chazelas
Dec 17 at 14:40
I am doing a CTF challenge and the hint tells me that i have to find a way to read a memory address (0x7fffffffeb58) of a ELF file/program and it will give me the value of an unsigned int.
– suppko
Dec 17 at 14:52
add a comment |
At the memory address, 0x7fffffffeb58 of a program lies a value, I want to find out the value of the address.
Is there a way to get the value just by using commands?
I've tried dd but to no avail.
linux command-line memory command dd
edited Dec 16 at 14:43
rudib
620417
asked Dec 16 at 12:55
suppko
63
At the memory address, 0x7fffffffeb58 of a program lies a value, I want to find out the value of the address.
Is there a way to get the value just by using commands?
I've tried dd but to no avail.
linux command-line memory command dd
linux command-line memory command dd
edited Dec 16 at 14:43
rudib
620417
asked Dec 16 at 12:55
suppko
63
edited Dec 16 at 14:43
rudib
620417
asked Dec 16 at 12:55
suppko
63
edited Dec 16 at 14:43
rudib
620417
edited Dec 16 at 14:43
rudib
620417
edited Dec 16 at 14:43
rudib
620417
620417
asked Dec 16 at 12:55
suppko
63
asked Dec 16 at 12:55
suppko
63
asked Dec 16 at 12:55
suppko
63
63
Can you give more context as to what you're trying to do?
– Stéphane Chazelas
Dec 17 at 14:40
I am doing a CTF challenge and the hint tells me that i have to find a way to read a memory address (0x7fffffffeb58) of a ELF file/program and it will give me the value of an unsigned int.
– suppko
Dec 17 at 14:52
add a comment |
Can you give more context as to what you're trying to do?
– Stéphane Chazelas
Dec 17 at 14:40
I am doing a CTF challenge and the hint tells me that i have to find a way to read a memory address (0x7fffffffeb58) of a ELF file/program and it will give me the value of an unsigned int.
– suppko
Dec 17 at 14:52
Can you give more context as to what you're trying to do?
– Stéphane Chazelas
Dec 17 at 14:40
Can you give more context as to what you're trying to do?
– Stéphane Chazelas
Dec 17 at 14:40
I am doing a CTF challenge and the hint tells me that i have to find a way to read a memory address (0x7fffffffeb58) of a ELF file/program and it will give me the value of an unsigned int.
– suppko
Dec 17 at 14:52
I am doing a CTF challenge and the hint tells me that i have to find a way to read a memory address (0x7fffffffeb58) of a ELF file/program and it will give me the value of an unsigned int.
– suppko
Dec 17 at 14:52
add a comment |
2 Answers
2
active
oldest
votes
To peek at memory addresses of a process, you can look at /proc/$pid/mem. See also /proc/$pid/maps for what's mapped in the process' address space.
You'll want to seek() within that file to the location you want, which you should be able to do with dd:
dd bs=1 skip="$((0x7fffffffeb58))" count=4 if="/proc/$pid/mem" |
od -An -vtu4
Would read 4 bytes at that address and interpret them as an unsigned 32 bit integer.
Another approach is to attach a debugger to the process:
gdb --batch -ex 'x/u 0x7fffffffeb58' -p "$pid"
In any case, note that depending on the value of the kernel.yama.ptrace_scope sysctl, you may need to have superuser privileges to do that.
answered Dec 16 at 15:31
Stéphane Chazelas
299k54563913
I tried to find the pid of my program using px ax but i found out that the process ID kept on changing and it is not inside proc/ folder. Am i doing something wrong here?
– suppko
Dec 17 at 14:09
@suppko you could try containing your process inside a cgroup, and then just access the pid in the cgroupcgcreate -g memoryto create a cgroup,cgexec --stickyto start the process in the cgroup created, andcat /path/to/cgroup/cgroup.procsto get pids.
– Dani_l
Dec 17 at 15:08
@suppko, you could start by suspending those processes (killall -STOP process_name) which would give you all the time you need to look at their memory.
– Stéphane Chazelas
Dec 17 at 17:22
add a comment |
If you want to access virtual memory of a specific process: refer to @Stéphane's answer.
If you want to access physical memory:
If you have devmem installed:
devmem 0x2000000
Alternative approach with hexdump:
hexdump -C --skip 0x7fffffffeb58 /dev/mem | head
See this question on StackOverflow.
answered Dec 16 at 14:34
rudib
620417
2
Note that there's a difference between virtual memory addresses which belong to a certain process, and physical memory addresses which you can access via/dev/mem. The OP likely meant a virtual address ("of a program" suggests this, though he didn't specify exactly).
– dirkt
Dec 17 at 9:15
I think you are right. I've added some explanation.
– rudib
Dec 17 at 12:44
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f489297%2fhow-to-get-value-of-a-memory-address-using-command%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
To peek at memory addresses of a process, you can look at /proc/$pid/mem. See also /proc/$pid/maps for what's mapped in the process' address space.
You'll want to seek() within that file to the location you want, which you should be able to do with dd:
dd bs=1 skip="$((0x7fffffffeb58))" count=4 if="/proc/$pid/mem" |
od -An -vtu4
Would read 4 bytes at that address and interpret them as an unsigned 32 bit integer.
Another approach is to attach a debugger to the process:
gdb --batch -ex 'x/u 0x7fffffffeb58' -p "$pid"
In any case, note that depending on the value of the kernel.yama.ptrace_scope sysctl, you may need to have superuser privileges to do that.
answered Dec 16 at 15:31
Stéphane Chazelas
299k54563913
I tried to find the pid of my program using px ax but i found out that the process ID kept on changing and it is not inside proc/ folder. Am i doing something wrong here?
– suppko
Dec 17 at 14:09
@suppko you could try containing your process inside a cgroup, and then just access the pid in the cgroupcgcreate -g memoryto create a cgroup,cgexec --stickyto start the process in the cgroup created, andcat /path/to/cgroup/cgroup.procsto get pids.
– Dani_l
Dec 17 at 15:08
@suppko, you could start by suspending those processes (killall -STOP process_name) which would give you all the time you need to look at their memory.
– Stéphane Chazelas
Dec 17 at 17:22
add a comment |
To peek at memory addresses of a process, you can look at /proc/$pid/mem. See also /proc/$pid/maps for what's mapped in the process' address space.
You'll want to seek() within that file to the location you want, which you should be able to do with dd:
dd bs=1 skip="$((0x7fffffffeb58))" count=4 if="/proc/$pid/mem" |
od -An -vtu4
Would read 4 bytes at that address and interpret them as an unsigned 32 bit integer.
Another approach is to attach a debugger to the process:
gdb --batch -ex 'x/u 0x7fffffffeb58' -p "$pid"
In any case, note that depending on the value of the kernel.yama.ptrace_scope sysctl, you may need to have superuser privileges to do that.
answered Dec 16 at 15:31
Stéphane Chazelas
299k54563913
I tried to find the pid of my program using px ax but i found out that the process ID kept on changing and it is not inside proc/ folder. Am i doing something wrong here?
– suppko
Dec 17 at 14:09
@suppko you could try containing your process inside a cgroup, and then just access the pid in the cgroupcgcreate -g memoryto create a cgroup,cgexec --stickyto start the process in the cgroup created, andcat /path/to/cgroup/cgroup.procsto get pids.
– Dani_l
Dec 17 at 15:08
@suppko, you could start by suspending those processes (killall -STOP process_name) which would give you all the time you need to look at their memory.
– Stéphane Chazelas
Dec 17 at 17:22
add a comment |
To peek at memory addresses of a process, you can look at /proc/$pid/mem. See also /proc/$pid/maps for what's mapped in the process' address space.
You'll want to seek() within that file to the location you want, which you should be able to do with dd:
dd bs=1 skip="$((0x7fffffffeb58))" count=4 if="/proc/$pid/mem" |
od -An -vtu4
Would read 4 bytes at that address and interpret them as an unsigned 32 bit integer.
Another approach is to attach a debugger to the process:
gdb --batch -ex 'x/u 0x7fffffffeb58' -p "$pid"
In any case, note that depending on the value of the kernel.yama.ptrace_scope sysctl, you may need to have superuser privileges to do that.
answered Dec 16 at 15:31
Stéphane Chazelas
299k54563913
To peek at memory addresses of a process, you can look at /proc/$pid/mem. See also /proc/$pid/maps for what's mapped in the process' address space.
You'll want to seek() within that file to the location you want, which you should be able to do with dd:
dd bs=1 skip="$((0x7fffffffeb58))" count=4 if="/proc/$pid/mem" |
od -An -vtu4
Would read 4 bytes at that address and interpret them as an unsigned 32 bit integer.
Another approach is to attach a debugger to the process:
gdb --batch -ex 'x/u 0x7fffffffeb58' -p "$pid"
In any case, note that depending on the value of the kernel.yama.ptrace_scope sysctl, you may need to have superuser privileges to do that.
answered Dec 16 at 15:31
Stéphane Chazelas
299k54563913
edited Dec 17 at 14:41
answered Dec 16 at 15:31
Stéphane Chazelas
299k54563913
answered Dec 16 at 15:31
Stéphane Chazelas
299k54563913
answered Dec 16 at 15:31
Stéphane Chazelas
299k54563913
299k54563913
I tried to find the pid of my program using px ax but i found out that the process ID kept on changing and it is not inside proc/ folder. Am i doing something wrong here?
– suppko
Dec 17 at 14:09
@suppko you could try containing your process inside a cgroup, and then just access the pid in the cgroupcgcreate -g memoryto create a cgroup,cgexec --stickyto start the process in the cgroup created, andcat /path/to/cgroup/cgroup.procsto get pids.
– Dani_l
Dec 17 at 15:08
@suppko, you could start by suspending those processes (killall -STOP process_name) which would give you all the time you need to look at their memory.
– Stéphane Chazelas
Dec 17 at 17:22
add a comment |
I tried to find the pid of my program using px ax but i found out that the process ID kept on changing and it is not inside proc/ folder. Am i doing something wrong here?
– suppko
Dec 17 at 14:09
@suppko you could try containing your process inside a cgroup, and then just access the pid in the cgroupcgcreate -g memoryto create a cgroup,cgexec --stickyto start the process in the cgroup created, andcat /path/to/cgroup/cgroup.procsto get pids.
– Dani_l
Dec 17 at 15:08
@suppko, you could start by suspending those processes (killall -STOP process_name) which would give you all the time you need to look at their memory.
– Stéphane Chazelas
Dec 17 at 17:22
I tried to find the pid of my program using px ax but i found out that the process ID kept on changing and it is not inside proc/ folder. Am i doing something wrong here?
– suppko
Dec 17 at 14:09
I tried to find the pid of my program using px ax but i found out that the process ID kept on changing and it is not inside proc/ folder. Am i doing something wrong here?
– suppko
Dec 17 at 14:09
@suppko you could try containing your process inside a cgroup, and then just access the pid in the cgroup
cgcreate -g memory to create a cgroup, cgexec --sticky to start the process in the cgroup created, and cat /path/to/cgroup/cgroup.procs to get pids.– Dani_l
Dec 17 at 15:08
@suppko you could try containing your process inside a cgroup, and then just access the pid in the cgroup
cgcreate -g memory to create a cgroup, cgexec --sticky to start the process in the cgroup created, and cat /path/to/cgroup/cgroup.procs to get pids.– Dani_l
Dec 17 at 15:08
@suppko, you could start by suspending those processes (
killall -STOP process_name) which would give you all the time you need to look at their memory.– Stéphane Chazelas
Dec 17 at 17:22
@suppko, you could start by suspending those processes (
killall -STOP process_name) which would give you all the time you need to look at their memory.– Stéphane Chazelas
Dec 17 at 17:22
add a comment |
If you want to access virtual memory of a specific process: refer to @Stéphane's answer.
If you want to access physical memory:
If you have devmem installed:
devmem 0x2000000
Alternative approach with hexdump:
hexdump -C --skip 0x7fffffffeb58 /dev/mem | head
See this question on StackOverflow.
answered Dec 16 at 14:34
rudib
620417
2
Note that there's a difference between virtual memory addresses which belong to a certain process, and physical memory addresses which you can access via/dev/mem. The OP likely meant a virtual address ("of a program" suggests this, though he didn't specify exactly).
– dirkt
Dec 17 at 9:15
I think you are right. I've added some explanation.
– rudib
Dec 17 at 12:44
add a comment |
If you want to access virtual memory of a specific process: refer to @Stéphane's answer.
If you want to access physical memory:
If you have devmem installed:
devmem 0x2000000
Alternative approach with hexdump:
hexdump -C --skip 0x7fffffffeb58 /dev/mem | head
See this question on StackOverflow.
answered Dec 16 at 14:34
rudib
620417
2
Note that there's a difference between virtual memory addresses which belong to a certain process, and physical memory addresses which you can access via/dev/mem. The OP likely meant a virtual address ("of a program" suggests this, though he didn't specify exactly).
– dirkt
Dec 17 at 9:15
I think you are right. I've added some explanation.
– rudib
Dec 17 at 12:44
add a comment |
If you want to access virtual memory of a specific process: refer to @Stéphane's answer.
If you want to access physical memory:
If you have devmem installed:
devmem 0x2000000
Alternative approach with hexdump:
hexdump -C --skip 0x7fffffffeb58 /dev/mem | head
See this question on StackOverflow.
answered Dec 16 at 14:34
rudib
620417
If you want to access virtual memory of a specific process: refer to @Stéphane's answer.
If you want to access physical memory:
If you have devmem installed:
devmem 0x2000000
Alternative approach with hexdump:
hexdump -C --skip 0x7fffffffeb58 /dev/mem | head
See this question on StackOverflow.
answered Dec 16 at 14:34
rudib
620417
edited Dec 17 at 12:43
answered Dec 16 at 14:34
rudib
620417
answered Dec 16 at 14:34
rudib
620417
answered Dec 16 at 14:34
rudib
620417
620417
2
Note that there's a difference between virtual memory addresses which belong to a certain process, and physical memory addresses which you can access via/dev/mem. The OP likely meant a virtual address ("of a program" suggests this, though he didn't specify exactly).
– dirkt
Dec 17 at 9:15
I think you are right. I've added some explanation.
– rudib
Dec 17 at 12:44
add a comment |
2
Note that there's a difference between virtual memory addresses which belong to a certain process, and physical memory addresses which you can access via/dev/mem. The OP likely meant a virtual address ("of a program" suggests this, though he didn't specify exactly).
– dirkt
Dec 17 at 9:15
I think you are right. I've added some explanation.
– rudib
Dec 17 at 12:44
2
2
Note that there's a difference between virtual memory addresses which belong to a certain process, and physical memory addresses which you can access via
/dev/mem. The OP likely meant a virtual address ("of a program" suggests this, though he didn't specify exactly).– dirkt
Dec 17 at 9:15
Note that there's a difference between virtual memory addresses which belong to a certain process, and physical memory addresses which you can access via
/dev/mem. The OP likely meant a virtual address ("of a program" suggests this, though he didn't specify exactly).– dirkt
Dec 17 at 9:15
I think you are right. I've added some explanation.
– rudib
Dec 17 at 12:44
I think you are right. I've added some explanation.
– rudib
Dec 17 at 12:44
add a comment |
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f489297%2fhow-to-get-value-of-a-memory-address-using-command%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Can you give more context as to what you're trying to do?
– Stéphane Chazelas
Dec 17 at 14:40
I am doing a CTF challenge and the hint tells me that i have to find a way to read a memory address (0x7fffffffeb58) of a ELF file/program and it will give me the value of an unsigned int.
– suppko
Dec 17 at 14:52