reading process memory

[Tofik Suleymanov]

Diomidis Spinellis wrote:
> Tofik Suleymanov wrote:
>>>   The only way you're going to be able to read another processes 
>>> address space is in the kernel.Even a process running as root is not 
>>> able to read another process's data.
>
> Incorrect; see this example:
>
> $ sed -e 's/this/that/' &
> [1] 87345
> $ /bin/su
> Password:
>
> # dd if=/proc/87345/mem conv=noerror 2> /dev/null | strings
> [...]
> @(#)compile.c   8.1 (Berkeley) 6/6/93
> [...]
> RE error: %s
> RuneMagiNONE
> /this/that/
> "s/this/that/
> s/this/that/
> this
> that
> that
>
>
I followed instructions in your email, but had no success of getting 
simmilar results. When trying to read from mem file of particular 
process i get error messages from dd:
(many of this records populate the screen)
0 bytes transferred in 6.393733 secs (0 bytes/sec)
dd: /proc/13150/mem: Bad address
dd: /proc/13150/mem: Bad address
0+0 records in
0+0 records out
0 bytes transferred in 6.393795 secs (0 bytes/sec)


while pid 13510 exists:
paranoia# ps ax |grep 13150
13150  p1  T      0:00.00 sed -e s/this/that/g
paranoia#


man 5 procfs says:

mem     The complete virtual memory image of the process.  Only those
             address which exist in the process can be accessed.  Reads and
             writes to this file modify the process.  Writes to the text 
seg-
             ment remain private to the process.
map     A map of the process' virtual memory.


I wonder why i cannot just dd data from mem ?