Skip to content

Instantly share code, notes, and snippets.

@Dbof
Created March 26, 2021 16:46
Show Gist options
  • Save Dbof/b9244cfc607cf2d33438826bee6f5056 to your computer and use it in GitHub Desktop.
Save Dbof/b9244cfc607cf2d33438826bee6f5056 to your computer and use it in GitHub Desktop.
Dump process memory in Linux. See this blog post for more: https://davidebove.com/blog/?p=1620
#! /usr/bin/env python3
import sys
import re
if __name__ == "__main__":
if len(sys.argv) != 2:
print('Usage:', sys.argv[0], '<process PID>', file=sys.stderr)
exit(1)
pid = sys.argv[1]
# maps contains the mapping of memory of a specific project
map_file = f"/proc/{pid}/maps"
mem_file = f"/proc/{pid}/mem"
# output file
out_file = f'{pid}.dump'
# iterate over regions
with open(map_file, 'r') as map_f, open(mem_file, 'rb', 0) as mem_f, open(out_file, 'wb') as out_f:
for line in map_f.readlines(): # for each mapped region
m = re.match(r'([0-9A-Fa-f]+)-([0-9A-Fa-f]+) ([-r])', line)
if m.group(3) == 'r': # readable region
start = int(m.group(1), 16)
end = int(m.group(2), 16)
mem_f.seek(start) # seek to region start
print(hex(start), '-', hex(end))
try:
chunk = mem_f.read(end - start) # read region contents
out_f.write(chunk) # dump contents to standard output
except OSError:
print(hex(start), '-', hex(end), '[error,skipped]', file=sys.stderr)
continue
print(f'Memory dump saved to {out_file}')
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment