tail head cat sleep
QR code linking to this page

Manual Pages  — KVM_READ


kvm_read, kvm_read2, kvm_write – read or write kernel virtual memory



Kernel Data Access Library (libkvm, -lkvm)


#include <kvm.h>

kvm_read(kvm_t *kd, unsigned long addr, void *buf, size_t nbytes);

kvm_read2(kvm_t *kd, kvaddr_t addr, void *buf, size_t nbytes);

kvm_write(kvm_t *kd, unsigned long addr, const void *buf, size_t nbytes);


The kvm_read(), kvm_read2(), and kvm_write() functions are used to read and write kernel virtual memory (or a crash dump file). See kvm_open(3) for information regarding opening kernel virtual memory and crash dumps.

The kvm_read() and kvm_read2() functions transfer nbytes bytes of data from the kernel space address addr to buf. Conversely, kvm_write() transfers data from buf to addr. Unlike their SunOS counterparts, these functions cannot be used to read or write process address spaces.

The kvm_read2() function uses a different type (kvaddr_t) for the addr argument to allow use of addresses larger than ULONG_MAX when examining non-native kernel images.


Upon success, the number of bytes actually transferred is returned. Otherwise, -1 is returned.


kvm(3), kvm_close(3), kvm_getargv(3), kvm_getenvv(3), kvm_geterr(3), kvm_getprocs(3), kvm_nlist(3), kvm_open(3), kvm_openfiles(3)

KVM_READ (3) November 27, 2015

tail head cat sleep
QR code linking to this page

Please direct any comments about this manual page service to Ben Bullock. Privacy policy.

Today, the Unix equivalent of a power drill would have 20 dials and switches, come with a nonstandard plug, require the user to hand-wind the motor coil, and not accept 3/8" or 7/8" drill bits (though this would be documented in the BUGS section of its instruction manual).
— The Unix Haters' handbook