Skip to content

Instantly share code, notes, and snippets.

@LAripping
Created January 12, 2021 17:28
Show Gist options
  • Save LAripping/f8b5b788ea317239431d57663c1ffe61 to your computer and use it in GitHub Desktop.
Save LAripping/f8b5b788ea317239431d57663c1ffe61 to your computer and use it in GitHub Desktop.
A simple Python script to dump the memory of a Linux process, using the `/proc/$PID/mem` and /proc/$PID/maps` pseudo-files. Replace "self" with the target PID
#! /usr/bin/env python
import re
maps_file = open("/proc/self/maps", 'r')
mem_file = open("/proc/self/mem", 'rb', 0)
output_file = open("self.dump", 'wb')
for line in maps_file.readlines(): # for each mapped region
m = re.match(r'([0-9A-Fa-f]+)-([0-9A-Fa-f]+) ([-r])', line)
if m.group(3) == 'r': # if this is a readable region
start = int(m.group(1), 16)
end = int(m.group(2), 16)
mem_file.seek(start) # seek to region start
chunk = mem_file.read(end - start) # read region contents
output_file.write(chunk) # dump contents to standard output
maps_file.close()
mem_file.close()
output_file.close()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment