Tools to view/edit user space memory of running processes?

Are there any tools to view/edit user space memory of running processes on Linux?

It would be a great learning tool.

Solution 1:

The memory of a process is available as the file /proc/12345/mem where 12345 is the process ID. You won't be able to learn anything directly from it for a while yet, though. The first thing to figure out is which parts are mapped; this information is available in /proc/12345/maps and /proc/12345/smaps. Entries in /proc are documented in the kernel documentation at Documentation/filesystems/proc.txt. The lsof command will give information about files that the process has mapped into memory in a more readable way.

It may be more instructive to look at the running process with a debugger. The usual debugger under Linux is Gdb. Gdb has a simple command line interface; DDD and Emacs provide user-friendlier interfaces. For best results, look at a program that still has debugging symbols and whose source is available (i.e. look at a program you just compiled with -g and haven't stripped).

You should also know about strace to watch the system calls a process is making, and ltrace to watch (some) library calls.