Extract VmRSS from /proc/self/status

Challenge

/proc/self/status has lines like:

Name:    cat
Pid:     12345
VmRSS:        1240 kB
Threads: 1

Implement long extract_vm_rss_kb(const char *status_blob) returning the VmRSS value in kB, or -1 if not found / parse failure.

Why this matters

In the Kali toolchain, the first thing you do on a foothold box is enumerate its own posture: who am I (uid/gid), what can I do (capabilities), what's loaded into me. /proc/self/status exposes all of that in a flat text format that an attacker would parse the same way a defender does — to know whether the process is privileged. We're writing the defender's parser: read the file's bytes, pull out the fields, hand them up the stack. No privilege escalation, no kernel writes — just a structured read of a virtual file every Linux process gets for free.

Input format

The full file contents as one blob.

Output format

kB or -1.

Constraints

sscanf with explicit width.

Starter code

long extract_vm_rss_kb(const char *status_blob) { /* TODO */ (void)status_blob; return -1; }

Common mistakes

Matching VmRSS inside another field like VmRSSData. Pin to start-of-line.

Edge cases to handle

Field absent. Field with leading spaces.

Complexity

O(strlen).

Background lessons

• /proc forensics — deep dive
• Log parsing — line iteration + classification

Up next

• Decide whether an fd-target string is suspicious
• Parse a /proc/self/maps line