Is there a way to see active mappings from virtual to physical memory in Linux?
To make simpler, let's assume we are on 32 bit system
Kernel Virtual Addresses
>>> 0xffffffff-0xc0000000
1073741823
Userspace Virtual Addresses
>>> 0xc0000000-0x00000000
3221225472
I want to scan Kernel Virtual Addresses for task_struct structure and was wondering if I have to scan the whole range or there is somehow a mapping which kernel virtual addresses are currently used?
Update 1:
How can I read it programatically to view all active mappings?
As I said I want to spare me going though the whole address space:
My code so far:
Here I try to scan the whole address space to look for task_struct and find the process name and PID (based on struct offsets)
#include <stdio.h>
#include <sys/types.h>
#include <unistd.h>
#include <sys/stat.h>
#include <sys/mman.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <stdbool.h>
void main()
{
    int fd;
    char *retp = NULL;
    fd = open("/dev/mem", O_RDWR|O_SYNC);
    for(int z=0;z<=0xffffffff;z=z+4096)
    {
        retp = mmap(NULL, 4096, PROT_READ, MAP_PRIVATE, fd,z);
        if (retp == MAP_FAILED)
        {
            printf("FAILED\n");
        }
        else
        {
            printf("PASSED\n");
            char task_struct[5760];
            int pid;
            for(int i=0;i<4096;i++)
            {
                memcpy(&task_struct,retp+i,5760);
                memcpy(&pid,task_struct+768,sizeof(int));
                if(strcmp(task_struct+996,"bash")==0)
                    printf("addr:%p\tname:%s\tpid:%i\n",retp+i,task_struct+996,pid);
            }
            munmap(retp,4096);
        }
    }
    close(fd);
}
