3 ms·
Yes, processes get their own address space, but there are APIs to read/write the address space of other processes, and on traditional desktop OSes, those APIs a
by geofft 8y ago
Yes, processes get their own address space, but there are APIs to read/write the address space of other processes, and on traditional desktop OSes, those APIs are accessible to other processes running as the same user. Virtual address spaces are for a) protection between processes running as different users and b) stability when other processes are incompetent but not malicious.
Windows: https://docs.microsoft.com/en-us/windows/desktop/api/memoryapi/nf-memoryapi-readprocessmemory https://docs.microsoft.com/en-us/windows/desktop/api/memorya...
macOS (Mach): https://developer.apple.com/documentation/kernel/1402405-mach_vm_read?language=objc https://developer.apple.com/documentation/kernel/1402405-mac...
Linux: /proc/*/mem or http://man7.org/linux/man-pages/man2/process_vm_readv.2.html http://man7.org/linux/man-pages/man2/process_vm_readv.2.html
and so forth.
- eridius 8y agoI was under the impression that on macOS you ultimately needed to get the task_t to do stuff with a target task, and that getting this for a target task was a privileged operation (unless the target task sent it to you).
- geofft 8y agoTrue - it has been getting increasingly hard on macOS (I just tried lldb on the command line and it's complaining about System Integrity Protection). It might actually be at the point where malicious software can't get access even with some cleverness?