jo-makar/proc-mem.md

## proc-mem.md

      
    Raw
  

              proc-mem.md
            
          
    Read live process memory

/proc/$pid/maps describes virtual memory regions with the first column being the address range
cd /proc/$pid/mem

# Extract the start and end address for the first entry (NR==1)
eval $(awk -F'[- ]' 'NR==1 {print "s="$1" e="$2}' maps)
/proc/$pid/mem provides access to the process' virtual memory
python3 -c 'f=open("mem","rb"); f.seek(0x'$s'); (f.read(0x'$e'-0x'$s'))' | hexdump -C