Also, I think the reason Suresh’s 1-line script does not work is because the address read for vdso is for process ‘cat’ and it is not a valid address when process ‘dd’ tries to read from /proc/self/mem. For it to work, the same process that reads the vdso address from /proc/self/maps needs to read linux-gate.so from /proc/self/mem.

-Ezra

#!/usr/bin/python

"""
http://anomit.com/2010/04/18/examining-the-linux-vdso/
http://gist.github.com/369785

This script writes the VDSO to the file linux-gate.dso.1 .
Use `objdump -d linux-gate.dso.1` to examine it.
You might also want to play around more with the other objdump options and
the readelf tool  

LICENSE: MIT License ( http://www.opensource.org/licenses/mit-license.php )
"""
#from __future__ import with_statement
import os
import re

## regex pattern for finding out the memory address range from the output line
pattern = re.compile(r'[\w\d]+-[\w\d]+')
file = open('/proc/self/maps', 'r')
for line in file:
    line = line.rstrip()
    if '[vdso]' in line:
        addr_range = pattern.findall(line)[0]
        start_addr, end_addr = [int(addr, 16)
                                for addr in addr_range.split('-')]
        break

fd = os.open('/proc/self/mem', os.O_RDONLY)
os.lseek(fd, start_addr, 0)
buf = os.read(fd, (end_addr-start_addr))

file = open('linux-gate.dso.1', 'w')
file.write(buf)
file.close()
os.close(fd)

Sorry for that. You can create just a simple file object using the normal open() and work with it .

Your dd 1-liner gives me the following error:

dd if=/proc/self/mem of=vdso skip=$((0x`cat /proc/self/maps | grep vdso | cut -d’-’ -f1`/0×1000)) count=1 bs=$((0×1000))
dd: reading `/proc/self/mem’: Input/output error
0+0 records in
0+0 records out
0 bytes (0 B) copied, 0.000162585 seconds, 0.0 kB/s

Do I need to do something to make /proc/self/mem readable? I am on 2.6.18 kernel.

Thanks.

[root@asm-99 ~]# ./vdso.py
File “./vdso.py”, line 20
with open(‘/proc/self/maps’, ‘r’) as file:
^
SyntaxError: invalid syntax

Do I need a particular version of python ? I am using 2.4.3.

Thanks

Seem to have missed objdump


dd if=/proc/self/mem of=- skip=$((0x`cat /proc/self/maps | grep vdso | cut -d'-' -f1`/0x1000)) count=1 bs=$((0x1000)) | objdump -d --start-address=0xffffe000 -