I want to find the physical address of a variable defined in a user-space process? Is there any way to do it using root privileges?
First, why would you want to do this? The purpose of modern VM systems is to remove the application programmer from the complexity of physocal memory layout. Gving them each their own uniform address space to make their life easyer.
If you did want to do this you would almost certanly need to use a kernel module. Get the virtual address of the variable in the normal way, use this to index into the processes page tables and read the value you find(the physical address of the frame). Then add the page offset to get the complete physical address. Note you wont be able to use this address while paging is enabled.
(If your lucky you may be able to get the frame address of a VM region from the /proc file system and thus wouldnt require to write a kernel module.)
-
4...and unless you lock the page into memory, that physical address could change at any time. – caf Mar 14 '10 at 9:22
-
1You don't need to write a kernel module: as the other examples explain, this is already exposed through
/proc/$pid/pagemap. – poolie Feb 11 '17 at 2:16 -
1It can be interesting in NUMA architectures to know the physical address of variables – horro Jul 26 '17 at 10:35
-
1
As partially answered before, normal programs should not need to worry about physical addresses as they run in a virtual address space with all its conveniences. Furthermore, not every virtual address has a physical address, the may belong to mapped files or swapped pages. However, sometimes it may be interesting to see this mapping, even in userland.
For this purpose, the Linux kernel exposes its mapping to userland through a set of files in the /proc. The documentation can be found here. Short summary:
/proc/$pid/mapsprovides a list of mappings of virtual addresses together with additional information, such as the corresponding file for mapped files./proc/$pid/pagemapprovides more information about each mapped page, including the physical address if it exists.
This website provides a C program that dumps the mappings of all running processes using this interface and an explanation of what it does.
-
Minimal example with tests: stackoverflow.com/questions/17021214/… – Ciro Santilli 新疆改造中心 六四事件 法轮功 Jul 16 '17 at 13:03
#include "stdio.h"
#include "unistd.h"
#include "inttypes.h"
uintptr_t vtop(uintptr_t vaddr) {
FILE *pagemap;
intptr_t paddr = 0;
int offset = (vaddr / sysconf(_SC_PAGESIZE)) * sizeof(uint64_t);
uint64_t e;
// https://www.kernel.org/doc/Documentation/vm/pagemap.txt
if ((pagemap = fopen("/proc/self/pagemap", "r"))) {
if (lseek(fileno(pagemap), offset, SEEK_SET) == offset) {
if (fread(&e, sizeof(uint64_t), 1, pagemap)) {
if (e & (1ULL << 63)) { // page present ?
paddr = e & ((1ULL << 54) - 1); // pfn mask
paddr = paddr * sysconf(_SC_PAGESIZE);
// add offset within page
paddr = paddr | (vaddr & (sysconf(_SC_PAGESIZE) - 1));
}
}
}
fclose(pagemap);
}
return paddr;
}
(edit: If by "physical address", you mean the level of "in which RAM module are my bits stored", then the following answer is inappropriate.)
You don't need root privileges to do this. What you need instead is a debugger. And here we go (using a Linux system on x86_64):
First we need a little program to play with. This one accesses a global variable and prints it two times in a row. It has two global variables, which we find in the memory later.
#include <stdio.h>
int a, b = 0;
int main(void)
{
printf("a: ");
if (fscanf("%d", &a) < 1)
return 0;
printf("a = %d\n", myglobal);
printf("b: ");
if (fscanf("%d", &b) < 1)
return 0;
printf("a = %d, b = %d\n", a, b);
return 0;
}
Step 1: Compile the program and strip all debug information from it, so we don't get any hints from the debugger that we wouldn't get in a real life situation.
$ gcc -s -W -Wall -Os -o ab ab.c
Step 2: Run the program and input one of the two numbers.
$ ./ab a: 123 a = 123 b: _
Step 3: Find the process.
$ ps aux | grep ab roland 21601 0.0 0.0 3648 456 pts/11 S+ 15:17 0:00 ./ab roland 21665 0.0 0.0 5132 672 pts/12 S+ 15:18 0:00 grep ab
Step 4: Attach a debugger to the process (21601).
$ gdb ... (gdb) attach 21601 ... (gdb) where #0 0x00007fdecfdd2970 in read () from /lib/libc.so.6 #1 0x00007fdecfd80b40 in _IO_file_underflow () from /lib/libc.so.6 #2 0x00007fdecfd8230e in _IO_default_uflow () from /lib/libc.so.6 #3 0x00007fdecfd66903 in _IO_vfscanf () from /lib/libc.so.6 #4 0x00007fdecfd7245c in scanf () from /lib/libc.so.6 #5 0x0000000000400570 in ?? () #6 0x00007fdecfd2f1a6 in __libc_start_main () from /lib/libc.so.6 #7 0x0000000000400459 in ?? () #8 0x00007fffd827da48 in ?? () #9 0x000000000000001c in ?? () #10 0x0000000000000001 in ?? () #11 0x00007fffd827f9a2 in ?? () #12 0x0000000000000000 in ?? ()
The interesting frame is number 5, since it is between some code calling the main function and the scanf function, so it must be our main function. Continuing the debugging session:
(gdb) frame 5 ... (gdb) disassemble $pc $pc+50 ... 0x0000000000400570 : test %eax,%eax 0x0000000000400572 : jle 0x40058c <scanf@plt+372> 0x0000000000400574 : mov 0x2003fe(%rip),%edx # 0x600978 <scanf@plt+2098528> 0x000000000040057a : mov 0x2003fc(%rip),%esi # 0x60097c <scanf@plt+2098532> 0x0000000000400580 : mov $0x40068f,%edi 0x0000000000400585 : xor %eax,%eax 0x0000000000400587 : callq 0x4003f8 <printf@plt> ...
Now we know that the function printf will get three parameters, and two of there are only four bytes away from each other. That's a good sign that these two are our variables a and b. So the address of a is either 0x600978 or 0x60097c. Let's find out by trying:
(gdb) x/w 0x60097c 0x60097c <scanf@plt+2098532>: 0x0000007b (gdb) x/w 0x600978 0x600978 <scanf@plt+2098528>: 0x00000000
So a, the variable that is read in first, is at address 0x60097c (because 0x0000007b is the hexadecimal representation for 123, which we entered), and b is at 0x600978.
Still in the debugger, we can modify the variable a now and then continue the program.
(gdb) set *(int *)0x60097c = 1234567 (gdb) continue
Back in the program that asked us to enter two numbers:
$ ./ab a: 123 a = 123 b: 5 a = 1234567, b = 5 $
-
11