November 7, 2011

Problem: Cannot access some valid ranges in /proc//mem

Hey Everyone,

I am having a problem accessing /proc/
/mem range after mprotect has made it readable. It almost seems the procfs driver is not aware of the updated permissions. Any ideas or hints would be great!

  • Process A ptrace ATTACHs to process B
  • Process A cannot access of a given range in process Bs /proc/
    /mem due to the associated mapping in /proc/
    /maps being non-readable
  • Process A requests process B use mprotect to mark given mapping as readable (mprotect returns success)
  • Process A now should be able to read the range in /proc/
    /mem but can only read part of the range...

Example:
Mapping Before Request (Step 3):
7f63671af000-7f63673ae000 ---p 0000c000 08:01 269062 /lib/x86_64-linux-gnu/libnss_files-2.13.so

Mapping After Request (Step 3):
7f63671af000-7f63673ae000 r--p 0000c000 08:01 269062 /lib/x86_64-linux-gnu/libnss_files-2.13.so

PROBLEM: std::ifstream can read a first part of the range from /proc/
/mem, but cannot read the remaining range data. (By cannot read I mean !fin.good and errno = 5)

Mapping Range: 7f63671af000-7f63673ae000 (2044 Kbytes)
Successfully Read Range: 7f63671af000-7f63671affff (4095 bytes, ~one page)
Unsuccessfully Read Range: 7f63671b0000-7f63673ae000 (2040 Kbytes)
Click Here!