Skip to content

Instantly share code, notes, and snippets.

@ktwombley
Created September 20, 2016 21:17
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save ktwombley/e333ba3d01e0fe81c44e3562fa74a931 to your computer and use it in GitHub Desktop.
Save ktwombley/e333ba3d01e0fe81c44e3562fa74a931 to your computer and use it in GitHub Desktop.
find /proc -type d -user ${username} -prune 2>/dev/null | sed -e 's/\/proc\///' | while read thepid; do echo ${thepid} && touch /sdcard/dumps/${thepid}.mem && cat /proc/${thepid}/maps | awk '{if (a) print a; a=$0}' | awk -F'[ -]' '{print "0x"$1" 0x"$2}' | while read start finish; do echo ${thepid} ${start} $(dc ${start} 0x1000 div p) $(((${finish}-${start})/4096)) && /data/local/busybox dd if=/proc/${thepid}/mem bs=4096 seek=$(dc ${start} 0x1000 div p) skip=$(dc ${start} 0x1000 div p) count=$(((${finish}-${start})/4096)) conv=noerror,notrunc,sync,fsync of=/sdcard/dumps/${thepid}.mem 2>/dev/null; done; done
# On android with busybox available at /data/local/busybox, will dump the process RAM of any process owned by $username into /sdcard/dumps/$thepid.mem. make that directory before starting.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment