Is it possible to read virtual memory even if /dev/kmem is not available? I know that I can recompile kernel to allow this file, but that's not the solution I'm looking for. Is there some tricky way I can read it sequentially e.g. from LKM? Are there some system calls which will give me direct access to virtual memory?
1 Answer
/dev/kmem is removed on most distribution because it is a tremendous security risk without any clearcut benign uses (yes, what you want to do according to the comment is violate the kernel's security). Perhaps some of the tracing packages give you what you need? System tap comes to mind...
/dev/kmem. My goal is to search through memory, find function calls and insert kprobes on their addresses.