Dump memory of a process

Question

When reading the /proc/$PID/maps you get the mapped memory regions. Is ther a way to dump one of this regions?

$ cat /proc/18448/maps
...[snip]...
0059e000-005b1000 r-xp 00000000 08:11 40         /usr/local/lib/libgstlightning.so.0.0.0
005b1000-005b2000 r--p 00012000 08:11 40         /usr/local/lib/libgstlightning.so.0.0.0
005b2000-005b3000 rw-p 00013000 08:11 40         /usr/local/lib/libgstlightning.so.0.0.0
...[snip]...

Thanks

Matt Joiner · Accepted Answer · 2016-06-23T07:48:04.527

14

Nah! Call ptrace() with PTRACE ATTACH. Then open /proc/<pid>/mem, seek to the region offset, and read the length of the region as given in /proc</pid>/maps.

Here's a program I wrote that does it in C. Here's a module I wrote that does it in Python (and the ptrace binding). For the finish, a program that dumps all regions of a process to files.

Enjoy!

edited Jun 23 '16 at 07:48

answered Jul 27 '10 at 14:01

Matt Joiner

112,946
110
377
526

nmichaels · Answer 2 · 2010-07-27T10:43:31.967

5

You can attach gdb to the process then dump memory region of length X words starting at location L with this: x/Xw L.

Attaching gdb when you start your process is simple: gdb ./executable then run. If you need to attach to a running process, start gdb then gdb attach pid where pid is is the process ID you care about.

edited Jul 27 '10 at 10:43

answered Jul 27 '10 at 10:26

nmichaels

49,466
12
107
135

Thanks, :) I haven't thought about it – mathk Jul 27 '10 at 12:37
1

You can use a command line argument to attach to a running process: `gdb -p `. – Matthew Slattery Jul 27 '10 at 23:39
Good to know. I've only used gdb seriously for remote targets. – nmichaels Jul 28 '10 at 11:44

score 4 · Answer 3 · answered Jul 27 '10 at 13:36

4

Using dd(1):

sudo dd if=/dev/mem bs=1 skip=$(( 16#0059e000 - 1 )) \
        count=$(( 16#005b1000 - 16#0059e000 + 1)) | hexdump -C

answered Jul 27 '10 at 13:36

jackIT

41
1

Dump memory of a process

3 Answers3

Linked