Dumping process memory - Revision history

Leo at 17:28, 2 October 2022

2022-10-02T17:28:25Z

← Older revision		Revision as of 17:28, 2 October 2022
Line 4:		Line 4:

	== Dumping process memory using Bash ==		== Dumping process memory using Bash ==
	{{Highlight		Here's a quick script that dumps all readable pages for a particular process using bash and dd. This script assumes 4K pages (<code>0x1000</code>).{{Highlight
	\| code = # PID=$pid cat /proc/$PID/maps \		\| code = ## Define your target PID
			# export PID=$target-pid

			## Dump memory
			# cat /proc/$PID/maps \
	{{!}} grep -ohE '[a-f0-9]+-[a-f0-9]+ r' \		{{!}} grep -ohE '[a-f0-9]+-[a-f0-9]+ r' \
	{{!}} tr - ' ' \		{{!}} tr - ' ' \
	{{!}} while read s e foo ; do		{{!}} while read s e foo ; do
	echo "Dumping $s to $e"		echo "Dumping $s to $e"
	dd if=/proc/$PID/mem bs=1 skip=$((0x$s)) count=$((0x$e - 0x$s)) >> /tmp/dump		dd if=/proc/$PID/mem bs=$((0x1000)) skip=$((0x$s / 0x1000)) count=$(((0x$e - 0x$s) / 0x1000)) >> /tmp/dump
	done		done
	\| lang = terminal		\| lang = terminal
	}}		}}

Leo at 17:23, 2 October 2022

2022-10-02T17:23:29Z

← Older revision		Revision as of 17:23, 2 October 2022
Line 5:		Line 5:
	== Dumping process memory using Bash ==		== Dumping process memory using Bash ==
	{{Highlight		{{Highlight
	\| code = # cat /proc/$~~pid~~/maps \		\| code = # PID=$pid cat /proc/$PID/maps \
	{{!}} grep -ohE '[a-f0-9]+-[a-f0-9]+ r' \		{{!}} grep -ohE '[a-f0-9]+-[a-f0-9]+ r' \
	{{!}} tr - ' ' \		{{!}} tr - ' ' \
	{{!}} while read s e foo ; do		{{!}} while read s e foo ; do
	echo "Dumping $s to $e"		echo "Dumping $s to $e"
	dd if=/proc/~~368~~/mem bs=1 skip=$((0x$s)) count=$((0x$e - 0x$s)) >> /tmp/dump		dd if=/proc/$PID/mem bs=1 skip=$((0x$s)) count=$((0x$e - 0x$s)) >> /tmp/dump
	done		done
	\| lang = terminal		\| lang = terminal
	}}		}}

Leo: /* Dumping process memory using Bash */

2022-10-02T17:21:51Z

Dumping process memory using Bash

← Older revision		Revision as of 17:21, 2 October 2022
Line 6:		Line 6:
	{{Highlight		{{Highlight
	\| code = # cat /proc/$pid/maps \		\| code = # cat /proc/$pid/maps \
	\| grep -ohE '[a-f0-9]+-[a-f0-9]+ r' \		{{!}} grep -ohE '[a-f0-9]+-[a-f0-9]+ r' \
	\| tr - ' ' \		{{!}} tr - ' ' \
	\| while read s e foo ; do		{{!}} while read s e foo ; do
	echo "Dumping $s to $e"		echo "Dumping $s to $e"
	dd if=/proc/368/mem bs=1 skip=$((0x$s)) count=$((0x$e - 0x$s)) >> /tmp/dump		dd if=/proc/368/mem bs=1 skip=$((0x$s)) count=$((0x$e - 0x$s)) >> /tmp/dump

Leo: Created page with "Every Linux process has a pseudo `mem` device which can be used to read the process's memory pages. This mem file is found under `/proc/$pid/mem`. In order to properly use this file, you have to read the readable sections as outlined by its corresponding `maps` file. Simply `dd if=/proc/$pid/mem` would not work as you will end up reading invalid or non-readable pages, resulting in a `Input/output error`. Instead, y..."

2022-10-02T17:21:34Z

Created page with "Every Linux process has a pseudo <code>mem</code> device which can be used to read the process's memory pages. This mem file is found under <code>/proc/$pid/mem</code>. In order to properly use this file, you have to read the readable sections as outlined by its corresponding <code>maps</code> file. Simply <code>dd if=/proc/$pid/mem</code> would not work as you will end up reading invalid or non-readable pages, resulting in a <code>Input/output error</code>. Instead, y..."

New page

Every Linux process has a pseudo <code>mem</code> device which can be used to read the process's memory pages. This mem file is found under <code>/proc/$pid/mem</code>. In order to properly use this file, you have to read the readable sections as outlined by its corresponding <code>maps</code> file.

Simply <code>dd if=/proc/$pid/mem</code> would not work as you will end up reading invalid or non-readable pages, resulting in a <code>Input/output error</code>. Instead, you should opt to use <code>gdb</code> to create a a core dump (using <code>gcore $pid</code>). On systems without <code>gdb</code> (think embedded systems), you may try to do this with the following bash-only solution.

== Dumping process memory using Bash ==
{{Highlight
| code = # cat /proc/$pid/maps \
| grep -ohE '[a-f0-9]+-[a-f0-9]+ r' \
| tr - ' ' \
| while read s e foo ; do
echo "Dumping $s to $e"
dd if=/proc/368/mem bs=1 skip=$((0x$s)) count=$((0x$e - 0x$s)) >> /tmp/dump
done
| lang = terminal
}}