Is there a way to see active mappings from virtual to physical memory in Linux?
To make simpler, let's assume we are on 32 bit system
Kernel Virtual Addresses
>>> 0xffffffff-0xc0000000
1073741823
Userspace Virtual Addresses
>>> 0xc0000000-0x00000000
3221225472
I want to scan Kernel Virtual Addresses for task_struct structure and was wondering if I have to scan the whole range or there is somehow a mapping which kernel virtual addresses are currently used?
Update 1:
How can I read it programatically to view all active mappings?
As I said I want to spare me going though the whole address space:
My code so far:
Here I try to scan the whole address space to look for task_struct and find the process name and PID (based on struct offsets)
#include <stdio.h>
#include <sys/types.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/mman.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <stdbool.h>
void main()
{
int fd;
char *retp = NULL;
fd = open("/dev/mem", O_RDWR|O_SYNC);
for(int z=0;z<=0xffffffff;z=z+4096)
{
retp = mmap(NULL, 4096, PROT_READ, MAP_PRIVATE, fd,z);
if (retp == MAP_FAILED)
{
printf("FAILED\n");
}
else
{
printf("PASSED\n");
char task_struct[5760];
int pid;
for(int i=0;i<4096;i++)
{
memcpy(&task_struct,retp+i,5760);
memcpy(&pid,task_struct+768,sizeof(int));
if(strcmp(task_struct+996,"bash")==0)
printf("addr:%p\tname:%s\tpid:%i\n",retp+i,task_struct+996,pid);
}
munmap(retp,4096);
}
}
close(fd);
}