🚀 go-pugleaf

I am developing a system which requires me to be able to access
  kernel data structures (specifically all information for a specified
  process, and the memory pages for that process).  In this system I
  need to be able to read the all data relavent to a process so I can
  store it, and read the memory pages individually, so I can store it.
  At some later point I will need to then reconstruct the process.  This
  reconstruction, most likely, will be simplest, if I just fork off an
  extra process, block it, then re-write it's process imformation, and
  memory pages with the stored information.

  To do this, I can obviously take one of two approaches;
    1)  Write a user space program (running as root probably), which
        accesses the kernel data structures, and reads the memory
        pages of the process directly.  With this method I need to
        know how to directly access kernel data structures, and
        any memory page in the system.  (Yes I realise that one of 
        the main jobs of a kernel is to prevent exactly this, which
        is why I am asking for information on how to do it)
    2)  I could make a new system call, which I compile in with the
        kernel.  Thus allowing direct access to the kernel data
        structures, and memory pages.  If I follow this approach, I
        need to know the mechanics of adding a system call to the 
        kernel, and how I can tell the compiler (with header files
        I assume) how it should resolve the system call.  Also if this
        new system call is a fairly long process (involving some 
        network I/O) will it halt all processing in the rest of the
        system?  If so would I possibly be better off writting a
        handful of system calls which allow me to read and alter
        the data structures and memory pages that I need to, then
        write a program which uses this handful of new system calls
        to do the work.

  Yes, these are _BIG_ questions, but I have as yet not been able to
  find direct answers to them so far.  I would appreciate any 
  information, pointers to information and suggestions you may have
  on these issues.

        ...thanks,
               Michael.


-- 
Michael Richmond
Basser Dept of Computer Science       e-mail:  mar@cs.usyd.edu.au
University of Sydney, Australia       phone:   (+61 2) 9351 4914