Why is dd unable to read /proc/pid/mem?

Question

Why is GNU Coreutil's dd unable to read /proc/pid/mem? PHP is able to read it, check this:

$ dd if=/proc/357668/mem bs=100 skip=93824992231424 count=1 iflag=fullblock
dd: /proc/357668/mem: cannot skip to specified offset
dd: error reading '/proc/357668/mem': Input/output error
0+0 records in
0+0 records out
0 bytes copied, 4.4742e-05 s, 0.0 kB/s
$ php -r '$h=fopen("/proc/357668/mem","rb");
var_dump(fseek($h,93824992231424));
var_dump(fread($h,100));'
int(0)
string(100) "^?ELF^B^A^A^C^@^@^@^@^@^@^@^@^C^@>^@^A^@^@^@<E0>^X^S^@^@^@^@^@@^@^@^@^@^@^@^@P*X^@^@^@^@^@^@^@^@^@@^@8^@^M^@@^@^^^@^]^@^F^@^@^@^D^@^@^@@^@^@^@^@^@^@^@@^@^@^@^@^@^@^@@^@^@^@^@^@^@^@<D8>^B^@^@"

here is strace of dd:

sudo strace dd if=/proc/357668/mem bs=1 skip=93824992231424 count=1 iflag=fullblock
execve("/usr/bin/dd", ["dd", "if=/proc/357668/mem", "bs=1", "skip=93824992231424", "count=1", "iflag=fullblock"], 0x7fffffffe528 /* 15 vars */) = 0
brk(NULL)                               = 0x555555567000
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ffff7fbd000
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=76631, ...}) = 0
mmap(NULL, 76631, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7ffff7faa000
close(3)                                = 0
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220\243\2\0\0\0\0\0"..., 832) = 832
pread64(3, "\6\0\0\0\4\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0"..., 784, 64) = 784
fstat(3, {st_mode=S_IFREG|0755, st_size=2125328, ...}) = 0
pread64(3, "\6\0\0\0\4\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0@\0\0\0\0\0\0\0"..., 784, 64) = 784
mmap(NULL, 2170256, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7ffff7d98000
mmap(0x7ffff7dc0000, 1605632, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x28000) = 0x7ffff7dc0000
mmap(0x7ffff7f48000, 323584, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1b0000) = 0x7ffff7f48000
mmap(0x7ffff7f97000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1fe000) = 0x7ffff7f97000
mmap(0x7ffff7f9d000, 52624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7ffff7f9d000
close(3)                                = 0
mmap(NULL, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ffff7d95000
arch_prctl(ARCH_SET_FS, 0x7ffff7d95740) = 0
set_tid_address(0x7ffff7d95a10)         = 364648
set_robust_list(0x7ffff7d95a20, 24)     = 0
rseq(0x7ffff7d96060, 0x20, 0, 0x53053053) = 0
mprotect(0x7ffff7f97000, 16384, PROT_READ) = 0
mprotect(0x555555565000, 4096, PROT_READ) = 0
mprotect(0x7ffff7ffb000, 8192, PROT_READ) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
munmap(0x7ffff7faa000, 76631)           = 0
rt_sigaction(SIGINT, NULL, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=0}, 8) = 0
rt_sigaction(SIGUSR1, {sa_handler=0x5555555589f0, sa_mask=[INT USR1], sa_flags=SA_RESTORER, sa_restorer=0x7ffff7ddd320}, NULL, 8) = 0
rt_sigaction(SIGINT, {sa_handler=0x5555555589e0, sa_mask=[INT USR1], sa_flags=SA_RESTORER|SA_NODEFER|SA_RESETHAND|0xffffffff00000000, sa_restorer=0x7ffff7ddd320}, NULL, 8) = 0
getrandom("\xbe\x2a\x3f\x3b\xa5\xd1\xca\xdc", 8, GRND_NONBLOCK) = 8
brk(NULL)                               = 0x555555567000
brk(0x555555588000)                     = 0x555555588000
openat(AT_FDCWD, "/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/share/locale/locale.alias", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=2996, ...}) = 0
read(3, "# Locale name alias data base.\n#"..., 4096) = 2996
read(3, "", 4096)                       = 0
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib/locale/C.UTF-8/LC_IDENTIFICATION", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/lib/locale/C.utf8/LC_IDENTIFICATION", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=258, ...}) = 0
mmap(NULL, 258, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7ffff7fbc000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib/x86_64-linux-gnu/gconv/gconv-modules.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=27028, ...}) = 0
mmap(NULL, 27028, PROT_READ, MAP_SHARED, 3, 0) = 0x7ffff7fb5000
close(3)                                = 0
futex(0x7ffff7f9c72c, FUTEX_WAKE_PRIVATE, 2147483647) = 0
openat(AT_FDCWD, "/usr/lib/locale/C.UTF-8/LC_MEASUREMENT", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/lib/locale/C.utf8/LC_MEASUREMENT", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=23, ...}) = 0
mmap(NULL, 23, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7ffff7fb4000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib/locale/C.UTF-8/LC_TELEPHONE", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/lib/locale/C.utf8/LC_TELEPHONE", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=47, ...}) = 0
mmap(NULL, 47, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7ffff7fb3000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib/locale/C.UTF-8/LC_ADDRESS", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/lib/locale/C.utf8/LC_ADDRESS", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=127, ...}) = 0
mmap(NULL, 127, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7ffff7fb2000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib/locale/C.UTF-8/LC_NAME", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/lib/locale/C.utf8/LC_NAME", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=62, ...}) = 0
mmap(NULL, 62, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7ffff7fb1000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib/locale/C.UTF-8/LC_PAPER", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/lib/locale/C.utf8/LC_PAPER", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=34, ...}) = 0
mmap(NULL, 34, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7ffff7fb0000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib/locale/C.UTF-8/LC_MESSAGES", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/lib/locale/C.utf8/LC_MESSAGES", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib/locale/C.utf8/LC_MESSAGES/SYS_LC_MESSAGES", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=48, ...}) = 0
mmap(NULL, 48, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7ffff7faf000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib/locale/C.UTF-8/LC_MONETARY", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/lib/locale/C.utf8/LC_MONETARY", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=270, ...}) = 0
mmap(NULL, 270, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7ffff7fae000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib/locale/C.UTF-8/LC_COLLATE", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/lib/locale/C.utf8/LC_COLLATE", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=1406, ...}) = 0
mmap(NULL, 1406, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7ffff7fad000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib/locale/C.UTF-8/LC_TIME", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/lib/locale/C.utf8/LC_TIME", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=3360, ...}) = 0
mmap(NULL, 3360, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7ffff7fac000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib/locale/C.UTF-8/LC_NUMERIC", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/lib/locale/C.utf8/LC_NUMERIC", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=50, ...}) = 0
mmap(NULL, 50, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7ffff7fab000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib/locale/C.UTF-8/LC_CTYPE", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory)
openat(AT_FDCWD, "/usr/lib/locale/C.utf8/LC_CTYPE", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=360460, ...}) = 0
mmap(NULL, 360460, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7ffff7d3c000
close(3)                                = 0
openat(AT_FDCWD, "/proc/357668/mem", O_RDONLY) = 3
dup2(3, 0)                              = 0
close(3)                                = 0
lseek(0, 0, SEEK_CUR)                   = 0
lseek(0, 93824992231424, SEEK_CUR)      = 93824992231424
fstat(0, {st_mode=S_IFREG|0600, st_size=0, ...}) = 0
write(2, "dd: ", 4dd: )                     = 4
write(2, "/proc/357668/mem: cannot skip to"..., 49/proc/357668/mem: cannot skip to specified offset) = 49
write(2, "\n", 1
)                       = 1
read(0, "\177", 1)                      = 1
write(1, "\177", 1)                     = 1
close(0)                                = 0
close(1)                                = 0
write(2, "1+0 records in\n1+0 records out\n", 311+0 records in
1+0 records out
) = 31
write(2, "1 byte copied, 0.000602349 s, 1."..., 381 byte copied, 0.000602349 s, 1.7 kB/s) = 38
write(2, "\n", 1
)                       = 1
close(2)                                = 0
exit_group(0)                           = ?
+++ exited with 0 +++

here is strace of php: https://pastebin.com/raw/9pacX2Q9 (warning: 190kb)

You could run both programs with strace and check what's different and how exactly the error occurs. — Bodo
– Bodo, Commented Jan 16 at 17:22

Bob Goddard · Accepted Answer · 2025-01-16 17:26:27Z

4

dd syscalls fstat against the file. As the file is virtual, it's size is returned as zero bytes. Therefore, as far as dd is concerned, it cannot seek to the required location since it is empty.

answered Jan 16 at 17:26

Bob Goddard

2,7411 gold badge8 silver badges11 bronze badges

Thanks! Wonder if there's any way to tell dd to ignore fstat

hanshenrik
– hanshenrik

2025-01-16 17:29:42 +00:00
Commented Jan 16 at 17:29
@hanshenrik, not that I can see.

Bob Goddard
– Bob Goddard

2025-01-16 17:33:26 +00:00
Commented Jan 16 at 17:33
I am currently making some tests and I am under the impression that dd outputs the warning cannot skip to specified offset but still does it because changing the skip variable results in different outputs from /proc/$pid/mem... (See my current question here: unix.stackexchange.com/q/797200/136276)

The Quark
– The Quark

2025-06-19 15:13:43 +00:00
Commented Jun 19 at 15:13

Add a comment |

Stack Exchange Network

Why is dd unable to read /proc/pid/mem?

1 Answer 1

You must log in to answer this question.

Linked

Hot Network Questions

Why is dd unable to read /proc/pid/mem?

1 Answer 1

You must log in to answer this question.

Linked

Related

Hot Network Questions