Skip to content

Instantly share code, notes, and snippets.

View DispatchCode's full-sized avatar
🏠
Working from home

Marco Crivellari DispatchCode

🏠
Working from home
View GitHub Profile
@DispatchCode
DispatchCode / new_syscall_and_hack.md
Created September 19, 2026 17:18
Linux Virtual Memory: Walking Page Tables with a Custom Syscall

When a user-space application accesses a virtual memory address, that address belongs to the address space of the corresponding process. Each user-space task has its own address space: the translation from a virtual address to a physical address starts from the CR3 value. Using this syscall, it is possible to read the memory of another running task.

This is intended for educational purposes only, so the code is by no means production-ready. It could also be interesting to add a syscall and walk the address space :)

Add a new syscall

I created a new folder called memory. This is where the source code will be placed. Kbuild also needs to be updated by adding the following line: