How to translate virtual to physical addresses through /proc/pid/pagemap

发布时间:2017-3-25 21:29:57 编辑:www.fx114.net 分享查询网我要评论
本篇文章主要介绍了"How to translate virtual to physical addresses through /proc/pid/pagemap ",主要涉及到How to translate virtual to physical addresses through /proc/pid/pagemap 方面的内容,对于How to translate virtual to physical addresses through /proc/pid/pagemap 感兴趣的同学可以参考一下。

How to translate virtual to physical addresses through /proc/pid/pagemap

墙外通道:http://fivelinesofcode.blogspot.com/2014/03/how-to-translate-virtual-to-physical.html

I currently work on a project where I need to make translations for virtual addresses of user-level application to physical addresses in Linux. I implemented my own system call to do that, but had hard times with verifying the results I'm getting.

Later I found out that in newer kernels there is a really nice virtual file in the /proc file system to get this information. I tried to cat it, doing cat /proc/self/pagemap, and got terrible binary output in my console.

So, it looks like working with this file is not such a pleasant experience. It's a binary file with all that it implies. I found couple of scripts that access this file and provide you with a nice text result, but unfortunately those were written in perl and ruby, and I needed to run it on very minimalistic embedded system. I needed something that fits into a single binary.

Long story short, I decided to bite the bullet and write a tool in C. My contribution might be helpful for someone, that's why I'm sharing this code.

#include <stdio.h>#include <stdlib.h>#include <unistd.h>#include <assert.h>#include <errno.h>#include <stdint.h>#define PAGEMAP_ENTRY 8#define GET_BIT(X,Y) (X & ((uint64_t)1<<Y)) >> Y#define GET_PFN(X) X & 0x7FFFFFFFFFFFFFconst int __endian_bit = 1;#define is_bigendian() ( (*(char*)&__endian_bit) == 0 )int i, c, pid, status;unsigned long virt_addr; uint64_t read_val, file_offset;char path_buf [0x100] = {};FILE * f;char *end;int read_pagemap(char * path_buf, unsigned long virt_addr);int main(int argc, char ** argv){   //printf("%lu\n", GET_BIT(0xA680000000000000, 63));   //return 0;   if(argc!=3){      printf("Argument number is not correct!\n pagemap PID VIRTUAL_ADDRESS\n");      return -1;   }   if(!memcmp(argv[1],"self",sizeof("self"))){      sprintf(path_buf, "/proc/self/pagemap");      pid = -1;   }   else{         pid = strtol(argv[1],&end, 10);         if (end == argv[1] || *end != '\0' || pid<=0){             printf("PID must be a positive number or 'self'\n");            return -1;            }       }   virt_addr = strtol(argv[2], NULL, 16);   if(pid!=-1)      sprintf(path_buf, "/proc/%u/pagemap", pid);      read_pagemap(path_buf, virt_addr);   return 0;}int read_pagemap(char * path_buf, unsigned long virt_addr){   printf("Big endian? %d\n", is_bigendian());   f = fopen(path_buf, "rb");   if(!f){      printf("Error! Cannot open %s\n", path_buf);      return -1;   }      //Shifting by virt-addr-offset number of bytes   //and multiplying by the size of an address (the size of an entry in pagemap file)   file_offset = virt_addr / getpagesize() * PAGEMAP_ENTRY;   printf("Vaddr: 0x%lx, Page_size: %d, Entry_size: %d\n", virt_addr, getpagesize(), PAGEMAP_ENTRY);   printf("Reading %s at 0x%llx\n", path_buf, (unsigned long long) file_offset);   status = fseek(f, file_offset, SEEK_SET);   if(status){      perror("Failed to do fseek!");      return -1;   }   errno = 0;   read_val = 0;   unsigned char c_buf[PAGEMAP_ENTRY];   for(i=0; i < PAGEMAP_ENTRY; i++){      c = getc(f);      if(c==EOF){         printf("\nReached end of the file\n");         return 0;      }      if(is_bigendian())           c_buf[i] = c;      else           c_buf[PAGEMAP_ENTRY - i - 1] = c;      printf("[%d]0x%x ", i, c);   }   for(i=0; i < PAGEMAP_ENTRY; i++){      //printf("%d ",c_buf[i]);      read_val = (read_val << 8) + c_buf[i];   }   printf("\n");   printf("Result: 0x%llx\n", (unsigned long long) read_val);   //if(GET_BIT(read_val, 63))   if(GET_BIT(read_val, 63))      printf("PFN: 0x%llx\n",(unsigned long long) GET_PFN(read_val));   else      printf("Page not present\n");   if(GET_BIT(read_val, 62))      printf("Page swapped\n");   fclose(f);   return 0;}

And now how you use it. It's very simple. Of course you need to compile it. Then you need to find out what mapping your target process does have. You can do that by reading /proc/pid/maps file. Fortunately that file is human readable.
When you know a valid virtual address, you can pass it to our tool to get actual value from pagemap, including physical frame number. Here is an example:

$ #let's find get virtual address of a page$ cat /proc/self/maps 00400000-0040b000 r-xp 00000000 08:02 1177367                            /bin/cat0060a000-0060b000 r--p 0000a000 08:02 1177367                            /bin/cat0060b000-0060c000 rw-p 0000b000 08:02 1177367                            /bin/cat0223a000-0225b000 rw-p 00000000 00:00 0                                  [heap]7fe7e15e1000-7fe7e1cc3000 r--p 00000000 08:02 1577390                    /usr/lib/locale/locale-archive7fe7e1cc3000-7fe7e1e80000 r-xp 00000000 08:02 527324                     /lib/x86_64-linux-gnu/libc-2.17.so7fe7e1e80000-7fe7e2080000 ---p 001bd000 08:02 527324                     /lib/x86_64-linux-gnu/libc-2.17.so7fe7e2080000-7fe7e2084000 r--p 001bd000 08:02 527324                     /lib/x86_64-linux-gnu/libc-2.17.so7fe7e2084000-7fe7e2086000 rw-p 001c1000 08:02 527324                     /lib/x86_64-linux-gnu/libc-2.17.so7fe7e2086000-7fe7e208b000 rw-p 00000000 00:00 0 7fe7e208b000-7fe7e20ae000 r-xp 00000000 08:02 527300                     /lib/x86_64-linux-gnu/ld-2.17.so7fe7e228d000-7fe7e2290000 rw-p 00000000 00:00 0 7fe7e22ab000-7fe7e22ad000 rw-p 00000000 00:00 0 7fe7e22ad000-7fe7e22ae000 r--p 00022000 08:02 527300                     /lib/x86_64-linux-gnu/ld-2.17.so7fe7e22ae000-7fe7e22b0000 rw-p 00023000 08:02 527300                     /lib/x86_64-linux-gnu/ld-2.17.so7fffce6b6000-7fffce6d7000 rw-p 00000000 00:00 0                          [stack]7fffce722000-7fffce724000 r-xp 00000000 00:00 0                          [vdso]ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]$ #don't forget alsr, normally only /bin/cat will remain same$ #so let's pick 0x00400000. Now we run our program. $ #First argument is pid, "self" is a legal option too, the second is virtual address$ ./pagemap self 0x00400000Reading /proc/self/pagemap at 0x2000Result: 0a60000000008c445

We got  0x0a60000000008c445 as a result. There are some bits showing that the page is valid, along with the size of the page. You can reed more in Linux documentation: https://www.kernel.org/doc/Documentation/vm/pagemap.txt. Basically, the physical page number is 0x8c445.

Note, that in different kernel versions bits 56-60 have different meaning. In most current versions, they are forced to zero, however in kernel version 3.11.0 they represent page size.

 

上一篇:字符串同构
下一篇:设置tomcat远程debug

相关文章

相关评论

本站评论功能暂时取消,后续此功能例行通知。

一、不得利用本站危害国家安全、泄露国家秘密,不得侵犯国家社会集体的和公民的合法权益,不得利用本站制作、复制和传播不法有害信息!

二、互相尊重,对自己的言论和行为负责。

好贷网好贷款