Read /proc/pid/maps using read()

Question

I want to extract the information from /proc/pid/maps, such as: the start address, the end address, and the permission.

However, for learning purpose, I want to use the low-level system call, such as: open, read, and lseek.

I am confused how to grep the information I need. There are some challenges I found:

1. How to read the whole file using read()?

Right now, I am using while((n = read(fd, buf, BUFSIZ)) > 0), to read the file, but apparently it reads in multiple batch, increasing the BUFSIZ * 2, does not solve the problem.

2. I am trying to grep the start address, by, read the character one by one until I find the - separator, and then lseek to the first character in the line and use read to get the start address. It works fine for the first iteration, but it mess up for the second iteration of while((n = read(fd, buf, BUFSIZ)) > 0).

What is the best way to extract the information?

Answer 1

• Yes, read(fd, buf, BUFSIZ) will read BUFSIZ bytes from fd (unless you’ve reached the last block, in which case it will read all the remaining bytes, the number of which will be returned in n and will be ≤BUFSIZ).  If you want to read all the data in one shot, you can do

  wc /proc/pid/maps

  to see how long it is (and hence how big to make BUFSIZ).  But this would be counterproductive.  Reading an entire file into memory is rarely necessary or even useful, and you can’t go around changing the parameters in your programs every time you run them on a different input file.  If you want to learn how to write programs that read files, you’ll be much better off learning how to handle them a block at a time.
• The second part of your question doesn’t make much sense.  grep?  Are you writing a C program or a shell script (or both)?
• And reading data that you want, throwing it away, and going back and reading it again is a really bad habit to get into.  It’s ridiculous to read the start address up to the -, and then lseek backwards and read it again — especially if you’re talking about reading the entire file into memory.  If you’ve got the entire file in memory, why in the world would you want to read part of it again?
• I would recommend using fgets.  But, if you really prefer to useread, go ahead and do it.  You’ll need to look for newline (\n) characters and so identify the lines (fgets would do this for you) and then extract the desired information from the lines.
• You can certainly analyze the lines character-by-character if you want.  But I recommend sscanf.  Be sure to check the return value.

Answer 2

Since /proc/pid/maps is a line-based file, using read() to read the file is kind of cumbersome. I would suggest using getline() or fscanf() for this purpose.