Read live process memory

proc-mem.md

Read live process memory

/proc/$pid/maps describes virtual memory regions with the first column being the address range

cd /proc/$pid/mem

# Extract the start and end address for the first entry (NR==1)
eval $(awk -F'[- ]' 'NR==1 {print "s="$1" e="$2}' maps)

/proc/$pid/mem provides access to the process' virtual memory

python3 -c 'f=open("mem","rb"); f.seek(0x'$s'); (f.read(0x'$e'-0x'$s'))' | hexdump -C