Accessing any memory locations under Linux 2.6.x

Question

Hey All,

I'm using Slackware 12.2 on an x86 machine. I'm trying to debug/figure out things by dumping specific parts of memory. Unfortunately my knowledge on the Linux kernel is quite limited to what I need for programming/pentesting.

So here's my question: Is there a way to access any point in memory? I tried doing this with a char pointer so that It would only be a byte long. However the program crashed and spat out something in that nature of: "can't access memory location". Now I was pointing at the 0x00000000 location which where the system stores it's interrupt vectors (unless that changed), which shouldn't matter really.

Now my understanding is the kernel will allocate memory (data, stack, heap, etc) to a program and that program will not be able to go anywhere else. So I was thinking of using NASM to tell the CPU to go directly fetch what I need but I'm unsure if that would work (and I would need to figure out how to translate MASM to NASM).

Alright, well there's my long winded monologue. Essentially my question is: "Is there a way to achieve this?".

Anyway...

Answer 1

If your program is running in user-mode, then memory outside of your process memory won't be accessible, by hook or by crook. Using asm will not help, nor will any other method. This is simply impossible, and is a core security/stability feature of any OS that runs in protected mode (i.e. all of them, for the past 20+ years). Here's a brief overview of Linux kernel memory management.

The only way you can explore the entire memory space of your computer is by using a kernel debugger, which will allow you to access any physical address. However, even that won't let you look at the memory of every process at the same time, since some processes will have been swapped out of main memory. Furthermore, even in kernel mode, physical addresses are not necessarily the same as the addresses visible to the process.

Answer 2

Take a look at /dev/mem or /dev/kmem (man mem) If you have root access you should be able to see your memory there. This is a mechanism used by kernel debuggers.

Note the warning: Examining and patching is likely to lead to unexpected results when read-only or write-only bits are present.

From the man page:

mem  is  a character device file that is an image of
the main memory of the computer.  It may be used, for
example, to examine (and even patch) the system.

Byte  addresses  in  mem  are interpreted as physical 
memory addresses. References to nonexistent locations 
cause errors to be returned.

...

The file kmem is the same as mem, except that the 
kernel virtual memory rather than physical memory is 
accessed.