获取一个进程的所有物理地址上的内存

1. 获取进程的所有PTE表项，从而得到所有物理地址

　　参考：https://www.cnblogs.com/pengdonglin137/p/6802108.html

　　通过/proc/pid/pagemap

　　

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <assert.h>
#include <errno.h>
#include <stdint.h>
#include <string.h>

#define PAGEMAP_ENTRY 8
#define GET_BIT(X,Y) (X & ((uint64_t)1<<Y)) >> Y
#define GET_PFN(X) X & 0x7FFFFFFFFFFFFF

const int __endian_bit = 1;
#define is_bigendian() ( (*(char*)&__endian_bit) == 0 )

int i, c, pid, status;
unsigned long virt_addr; 
uint64_t read_val, file_offset, page_size;
char path_buf [0x100] = {};
FILE * f;
char *end;

int read_pagemap(char * path_buf, unsigned long virt_addr);

int main(int argc, char ** argv){
    if(argc!=3){
        printf("Argument number is not correct!
 pagemap PID VIRTUAL_ADDRESS
");
        return -1;
    }
    if(!memcmp(argv[1],"self",sizeof("self"))){
        sprintf(path_buf, "/proc/self/pagemap");
        pid = -1;
    }
    else{
        pid = strtol(argv[1],&end, 10);
        if (end == argv[1] || *end != '' || pid<=0){ 
            printf("PID must be a positive number or 'self'
");
            return -1;
        }
    }
    virt_addr = strtoll(argv[2], NULL, 16);
    if(pid!=-1)
        sprintf(path_buf, "/proc/%u/pagemap", pid);

    page_size = getpagesize();
    read_pagemap(path_buf, virt_addr);
    return 0;
}

int read_pagemap(char * path_buf, unsigned long virt_addr){
    printf("Big endian? %d
", is_bigendian());
    f = fopen(path_buf, "rb");
    if(!f){
        printf("Error! Cannot open %s
", path_buf);
        return -1;
    }

    //Shifting by virt-addr-offset number of bytes
    //and multiplying by the size of an address (the size of an entry in pagemap file)
    file_offset = virt_addr / page_size * PAGEMAP_ENTRY;
    printf("Vaddr: 0x%lx, Page_size: %lld, Entry_size: %d
", virt_addr, page_size, PAGEMAP_ENTRY);
    printf("Reading %s at 0x%llx
", path_buf, (unsigned long long) file_offset);
    status = fseek(f, file_offset, SEEK_SET);
    if(status){
        perror("Failed to do fseek!");
        return -1;
    }
    errno = 0;
    read_val = 0;
    unsigned char c_buf[PAGEMAP_ENTRY];
    for(i=0; i < PAGEMAP_ENTRY; i++){
        c = getc(f);
        if(c==EOF){
            printf("
Reached end of the file
");
            return 0;
        }
        if(is_bigendian())
            c_buf[i] = c;
        else
            c_buf[PAGEMAP_ENTRY - i - 1] = c;
        printf("[%d]0x%x ", i, c);
    }
    for(i=0; i < PAGEMAP_ENTRY; i++){
        //printf("%d ",c_buf[i]);
        read_val = (read_val << 8) + c_buf[i];
    }
    printf("
");
    printf("Result: 0x%llx
", (unsigned long long) read_val);
    if(GET_BIT(read_val, 63)) {
        uint64_t pfn = GET_PFN(read_val);
        printf("PFN: 0x%llx (0x%llx)
", pfn, pfn * page_size + virt_addr % page_size);
    } else
        printf("Page not present
");
    if(GET_BIT(read_val, 62))
        printf("Page swapped
");
    fclose(f);
    return 0;
}

2. 通过mmap /dev/mem获取物理地址的存储内容

　　参考：https://blog.csdn.net/zhanglei4214/article/details/6653568

3. 获取之后：就有很多好玩的东东啦

　　a. 比如做crc校验，找出是否有人踩这个内存

　　b. 比如可以篡改内容，搞挂别人的程序

　　。。。