Dumping process memory: Difference between revisions
From Leo's Notes
This page was last edited on 2 October 2022, at 17:21.
Created page with "Every Linux process has a pseudo <code>mem</code> device which can be used to read the process's memory pages. This mem file is found under <code>/proc/$pid/mem</code>. In order to properly use this file, you have to read the readable sections as outlined by its corresponding <code>maps</code> file. Simply <code>dd if=/proc/$pid/mem</code> would not work as you will end up reading invalid or non-readable pages, resulting in a <code>Input/output error</code>. Instead, y..." |
|||
| Line 6: | Line 6: | ||
{{Highlight | {{Highlight | ||
| code = # cat /proc/$pid/maps \ | | code = # cat /proc/$pid/maps \ | ||
{{!}} grep -ohE '[a-f0-9]+-[a-f0-9]+ r' \ | |||
{{!}} tr - ' ' \ | |||
{{!}} while read s e foo ; do | |||
echo "Dumping $s to $e" | echo "Dumping $s to $e" | ||
dd if=/proc/368/mem bs=1 skip=$((0x$s)) count=$((0x$e - 0x$s)) >> /tmp/dump | dd if=/proc/368/mem bs=1 skip=$((0x$s)) count=$((0x$e - 0x$s)) >> /tmp/dump | ||
Revision as of 17:21, 2 October 2022
Every Linux process has a pseudo mem device which can be used to read the process's memory pages. This mem file is found under /proc/$pid/mem. In order to properly use this file, you have to read the readable sections as outlined by its corresponding maps file.
Simply dd if=/proc/$pid/mem would not work as you will end up reading invalid or non-readable pages, resulting in a Input/output error. Instead, you should opt to use gdb to create a a core dump (using gcore $pid). On systems without gdb (think embedded systems), you may try to do this with the following bash-only solution.
Dumping process memory using Bash
# cat /proc/$pid/maps \
| grep -ohE '[a-f0-9]+-[a-f0-9]+ r' \
| tr - ' ' \
| while read s e foo ; do
echo "Dumping $s to $e"
dd if=/proc/368/mem bs=1 skip=$((0x$s)) count=$((0x$e - 0x$s)) >> /tmp/dump
done