Linux Memory Dump

dump.rb

#!/usr/bin/env ruby

# This script reads a list of PIDs from the command line and dumps all readable memory regions.

REGION_PATTERN = /(\h+)-(\h+) (r)/

ARGV.each do |pid|
	maps = File.open("/proc/#{pid}/maps")
	mem = File.open("/proc/#{pid}/mem")

	maps.each_line do |line|
		if match = line.match(REGION_PATTERN)
			offset = Integer(match[1], 16)
			size = Integer(match[2], 16) - offset
			begin
				$stderr.puts "Reading from #{offset} +#{size}..."
				$stdout.write mem.pread(size, offset)
			rescue Errno::EIO => error
				$stderr.puts error
			end
		end
	end
end