# Is it possible to extract data out of memory using Ruby?

**URL:** <https://www.ruby-forum.com/t/is-it-possible-to-extract-data-out-of-memory-using-ruby/145817>\
**Category:** Ruby\
**Created:** [August 14, 2008, 9:34am UTC](https://www.ruby-forum.com/t/is-it-possible-to-extract-data-out-of-memory-using-ruby/145817 "2008-08-14T09:34:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![eterps](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/ecd19e/32.png) [@eterps](https://www.ruby-forum.com/u/eterps)\
**Post date:** [August 14, 2008, 9:34am UTC](https://www.ruby-forum.com/t/is-it-possible-to-extract-data-out-of-memory-using-ruby/145817/1 "2008-08-14T09:34:02Z")

</div>

Is it possible to extract data out of memory using Ruby?

Something like this: Memory.get\_byte(pos)

Or something like this Perl module:

[Disassemble::X86::MemRegion - Represent a region of memory - metacpan.org](http://search.cpan.org/~bobmath/Disassemble-X86-0.13/X86/MemRegion.pm)

This Perl module is _not_ an extension in C, I am not sure how the  
author pulled that off. I looked at the source code, but I am not very  
good at Perl.

- Erik

---

<div class="post-metadata">

**Author:** ![eterps](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/ecd19e/32.png) [@eterps](https://www.ruby-forum.com/u/eterps)\
**Post date:** [August 14, 2008, 9:45am UTC](https://www.ruby-forum.com/t/is-it-possible-to-extract-data-out-of-memory-using-ruby/145817/2 "2008-08-14T09:45:26Z")

</div>

2008/8/14 Erik T. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid):

> Is it possible to extract data out of memory using Ruby?

Erik, to read and write longs (4 bytes) I use the DL standard library  
with the following code:

require “dl”

ptr = DL::PtrData.new 0  
ptr.struct! “L”, “val”  
size = ptr.size

# read

ptr[address, size].unpack( “L” )[0]

# write

ptr[address, size] = [val].pack( “L” )

For reading and writing bytes you have to change the “L” to something  
else. See the docs for the DL standard library.

Regards,  
Pit

---

<div class="post-metadata">

**Author:** ![eterps](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/ecd19e/32.png) [@eterps](https://www.ruby-forum.com/u/eterps)\
**Post date:** [August 14, 2008, 5:18pm UTC](https://www.ruby-forum.com/t/is-it-possible-to-extract-data-out-of-memory-using-ruby/145817/3 "2008-08-14T17:18:33Z")

</div>

So if you would like to look at the ‘in memory’ representation of a Ruby  
String how would that work?

require “dl”

ptr = DL::PtrData.new 0  
ptr.struct! “L”, “val”  
size = ptr.size

str = ‘Hello world!’  
address = str.object\_id \* 2  
value = ptr[address, size]

puts [address, value].inspect

TIA,

Erik.

Pit C. wrote:

> 2008/8/14 Erik T. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid):
> 
> > Is it possible to extract data out of memory using Ruby?
> 
> Erik, to read and write longs (4 bytes) I use the DL standard library  
> with the following code:
> 
> require “dl”
> 
> ptr = DL::PtrData.new 0  
> ptr.struct! “L”, “val”  
> size = ptr.size
> 
> # read
> 
> ptr[address, size].unpack( “L” )[0]
> 
> # write
> 
> ptr[address, size] = [val].pack( “L” )
> 
> For reading and writing bytes you have to change the “L” to something  
> else. See the docs for the DL standard library.
> 
> Regards,  
> Pit

---

<div class="post-metadata">

**Author:** ![eterps](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/ecd19e/32.png) [@eterps](https://www.ruby-forum.com/u/eterps)\
**Post date:** [August 15, 2008, 9:11am UTC](https://www.ruby-forum.com/t/is-it-possible-to-extract-data-out-of-memory-using-ruby/145817/4 "2008-08-15T09:11:36Z")

</div>

2008/8/14 Erik T. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid):

> So if you would like to look at the ‘in memory’ representation of a Ruby  
> String how would that work?

Erik, you have to look at the C source code of Ruby to find the  
structure of String instances. In MRI 1.8, you can get at the address  
of a Ruby object via

object.object\_id \* 2

Regards,  
Pit