🔒 Locked

memory protection in Linux/Win 2k

Started by Z01 Aug 2, 2001 at 12:55 AM 6 replies 650+ views

Original Post

Aug 2, 2001 at 12:55 AM

I was recently writing a C program. I noticed that Linux gives me a segmentation fault when I attempt to read memory not in the page allocated to my process. But Win2k seems to allow me to read other memory pages (that may belong to another process). I did this simply by reading down (up?) the stack until you pass the edge of the page: int i; int j; int * k; k = &i for (j=0;j<100000 /* some big number */; j++) { printf("Addr: %x\tValue: %x %d\n", &k[-j], k[-j], j); } Is this correct, or am i missing something? So any application running in Win2k can read any other applications data? Edited by - Z01 on August 2, 2001 1:59:32 AM

gph-gw

Aug 2, 2001 at 2:56 AM

I think you can as long as you''re running under a privliged account. I''m no expert on win2k so I might be wrong.

Of course, this is windows we''re talking about, so I wouldn''t rule out OS bug.

Eraserhead

Aug 2, 2001 at 8:59 AM

From what I can remember of NT''s memory architecture, there exists no such thing as ''other application''s pages'' within the virtual memory space of an app.

merlin9x9

Aug 2, 2001 at 12:55 PM

To my knowledge, NT does have the concept of protected memory, which is why so many poorly-written apps that run fine on 9x die miserably on NT with an access violation. To gain legal access to memory belonging to other processes, there are certain priviliges your process needs to have (and, for all I know, your process might need to be a service or a driver). But I have no idea why what you tried didn''t cause any problems. It''s possible that 2000 just happened to give you a sufficiently large stack or otherwise large memory sandbox, but I really don''t know.

Epolevne

Aug 2, 2001 at 7:19 PM

Win2k uses virtual memory spaces....so your program could (theoretically) address the full range of memory w/o overwriting another program.

Epolevne

Z01

Aug 2, 2001 at 10:04 PM

Thanks for you answers

I know that my program could allocate up to the theoretical 4GB max, but I was reading memory that I hadn''t allocated. Maybe Win2k was doing something tricky behind the scenes, or maybe you are allowed to read, but not write to memory not belonging to your process? Anyways, I''ll think about it more.

Martee

Aug 2, 2001 at 10:24 PM

I don''t see what the problem is here...
I just ran your code, and once j gets past about 1200, it''s all 0''s. Presumably, stuff below 1200 is the app itself.

As previously mentioned, NT runs each app in its own memory space. You can look or write over all the memory you want, but you''ll never hit another processes'' pages.

IIRC, a program must be running in ring 0 to access the pages of other processes, or of the OS itself.

If anybody is interested, here''s a great article about NT''s memory subsystem architecture.

~~~~~~~~~~
Martee

GayleSaver

Aug 2, 2001 at 11:27 PM

Please don''t forget the kernel and shared memory spaces. In NT they are all protected with NO_ACCESS, but in Windows 9x they are writeable. Hence, any application can write random data to the kernel.

Shudder.

Topic Locked

This topic has been locked by a moderator. New replies are not allowed.