Last active
June 28, 2020 06:42
-
-
Save slick1015/36aacd9e7d32ed844fa73bb498ceb56e to your computer and use it in GitHub Desktop.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
import os | |
maps_file = open("/proc/25397/maps", "r") | |
mem_file = open("/proc/25397/mem", "rb") | |
for line in maps_file.readlines(): # for each mapped region | |
pathname = "" | |
addresses, perms, offset, dev, inode, *rest = line.split() | |
if len(rest) > 0 and rest[0]: # for some reason not everything has a pathname | |
pathname = rest[0] | |
start, end, *rest = addresses.split("-") | |
if "r" in perms: | |
print("Processing: " + addresses) | |
try: | |
# print(start) | |
# print(addresses + " - " + hex(int(start, 16)) + " - " + str(int(start, 16))) | |
mem_file.seek(int(start, 16), 0) | |
chunk = mem_file.read(int(end, 16) - int(start, 16)) | |
out = open("/data/local/tmp/dump/%s_%s_%s.bin" % (addresses, pathname.replace("/", "-"), perms), "wb") | |
out.write(chunk) | |
out.close() | |
except Exception as e: | |
print("Error: " + line[:-1]) | |
print(e) | |
maps_file.close() | |
mem_file.close() |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment