Skip to content

Instantly share code, notes, and snippets.

@KeyboardInterrupt
Forked from Dbof/memdump.py
Last active May 31, 2022 10:35
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save KeyboardInterrupt/9aecd53bb36bd4146ba550f15c10da03 to your computer and use it in GitHub Desktop.
Save KeyboardInterrupt/9aecd53bb36bd4146ba550f15c10da03 to your computer and use it in GitHub Desktop.
Dump process memory in Linux. See this blog post for more: https://davidebove.com/blog/?p=1620
#! /usr/bin/env python3
import sys
import re
if __name__ == "__main__":
if len(sys.argv) != 2:
print('Usage:', sys.argv[0], '<process PID>', file=sys.stderr)
exit(1)
pid = sys.argv[1]
# maps contains the mapping of memory of a specific project
map_file = f"/proc/{pid}/maps"
mem_file = f"/proc/{pid}/mem"
# output file
out_file = f'{pid}.dump'
# iterate over regions
with open(map_file, 'r') as map_f, open(mem_file, 'rb', 0) as mem_f:
with open(f'{pid}.map','w') as map_f_out:
map_f_out.write(map_f.read())
map_f.seek(0)
for line in map_f.readlines(): # for each mapped region
m = re.match(r'([0-9A-Fa-f]+)-([0-9A-Fa-f]+) ([-r])', line)
if m.group(3) == 'r': # readable region
start = int(m.group(1), 16)
end = int(m.group(2), 16)
mem_f.seek(start) # seek to region start
print(f"{hex(start)}-{hex(end)}")
with open(f'{pid}_{hex(start)}-{hex(end)}.dump', 'wb') as out_f:
try:
chunk = mem_f.read(end - start) # read region contents
out_f.write(chunk) # dump contents to standard output
except OSError:
print(hex(start), '-', hex(end), '[error,skipped]', file=sys.stderr)
continue
print(f'Memory dump saved to {out_file}')
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment