Extract VmRSS from /proc/self/status

Challenge

Find the VmRSS: line in a /proc/self/status blob and return its kilobyte value — the resident memory size of a process.

Task

Implement long extract_vm_rss_kb(const char *status_blob) that returns the VmRSS value in kB.

Input

• status_blob: the full text of a /proc/<pid>/status file, with lines like:

Name:    cat
Pid:     12345
VmRSS:        1240 kB
Threads: 1

Output

Returns the integer that follows VmRSS: (in kB), or -1 if the field is absent, the input is NULL, or the value cannot be parsed.

Example

extract_vm_rss_kb(blob containing "VmRSS:\t    1240 kB")   ->   1240
extract_vm_rss_kb("VmRSS:\t       0 kB\n")                 ->   0
extract_vm_rss_kb("Name:\tx\nPid:\t1\n")                  ->   -1   (no VmRSS line)
extract_vm_rss_kb(NULL)                                    ->   -1

Edge cases

• Field absent or input NULL: -1.
• A VmRSS of 0 is a valid result (returns 0, not -1).
• The value may have leading whitespace before the number.

Why this matters

In the Kali toolchain, the first thing you do on a foothold box is enumerate its own posture: who am I (uid/gid), what can I do (capabilities), what's loaded into me. /proc/self/status exposes all of that in a flat text format that an attacker would parse the same way a defender does — to know whether the process is privileged. We're writing the defender's parser: read the file's bytes, pull out the fields, hand them up the stack. No privilege escalation, no kernel writes — just a structured read of a virtual file every Linux process gets for free.

Input format

The full /proc//status text as one string (may be NULL).

Output format

The integer after 'VmRSS:' in kB, or -1 if absent/NULL/unparseable.

Constraints

Match the VmRSS field and read the number after it; a value of 0 is valid.

Starter code

long extract_vm_rss_kb(const char *status_blob) { /* TODO */ (void)status_blob; return -1; }

Common mistakes

Matching VmRSS inside another field like VmRSSData. Pin to start-of-line.

Edge cases to handle

Field absent. Field with leading spaces.

Complexity

O(strlen).

Background lessons

• /proc forensics — deep dive
• Log parsing — line iteration + classification

Up next

• Decide whether an fd-target string is suspicious
• Parse a /proc/self/maps line