KVM_READ(3)

💅 KVM_READ(3) 💅

okay bestie, this one’s from the Library Functions Manual, and it’s all about peeking into — and writing to — kernel virtual memory. iconic behavior, honestly. 🫶

---

🌸 NAME 🌸

• kvm_read, kvm_read2, kvm_write — read or write kernel virtual memory

---

🎀 LIBRARY 🎀

Kernel Data Access Library (libkvm, -lkvm)

---

✨ SYNOPSIS ✨

#include <kvm.h>

ssize_t
kvm_read(kvm_t *kd, unsigned long addr, void *buf, size_t nbytes);

ssize_t
kvm_read2(kvm_t *kd, kvaddr_t addr, void *buf, size_t nbytes);

ssize_t
kvm_write(kvm_t *kd, unsigned long addr, const void *buf,
    size_t nbytes);

---

🦋 DESCRIPTION 🦋

so like, kvm_read(), kvm_read2(), and kvm_write() are the functions you use to read and write kernel virtual memory (or a crash dump file). for the whole “how do I even open kernel virtual memory and crash dumps” situation, go check kvm_open(3). iykyk 💖

kvm_read() and kvm_read2() transfer nbytes bytes of data from the kernel space address addr to buf. meanwhile, kvm_write() goes the other way and transfers data from buf to addr. ✨

and bestie, listen: unlike their SunOS counterparts, these functions cannot be used to read or write process address spaces. periodt. 💅

kvm_read2() uses a different type (kvaddr_t) for the addr argument, which lets you use addresses larger than ULONG_MAX when you’re examining non-native kernel images. slay. 🌈

---

💖 RETURN VALUES 💖

on success, the number of bytes actually transferred is returned. otherwise, -1 is returned. simple as that. 🎀

---

🌟 SEE ALSO 🌟

• kvm(3)
• kvm_close(3)
• kvm_getargv(3)
• kvm_getenvv(3)
• kvm_geterr(3)
• kvm_getprocs(3)
• kvm_nlist(3)
• kvm_open(3)
• kvm_openfiles(3)

---

👑 HISTORY 👑

kvm_read2() first appeared in FreeBSD 11.0. noted. ⭐

---

peace out, bestie 🫶 — this page is from Debian, dated November 27, 2015, and its title is KVM_READ(3). 💜