Skip to content

Instantly share code, notes, and snippets.

@mickys
Created June 10, 2019 15:33
Show Gist options
  • Save mickys/6d15af5e154457aeaf8315112894e8c1 to your computer and use it in GitHub Desktop.
Save mickys/6d15af5e154457aeaf8315112894e8c1 to your computer and use it in GitHub Desktop.
proc_memory_dump.py
#! /usr/bin/env python
import re
maps_file = open("/proc/3778/maps", 'r')
mem_file = open("/proc/3778/mem", 'r', 0)
for line in maps_file.readlines(): # for each mapped region
m = re.match(r'([0-9A-Fa-f]+)-([0-9A-Fa-f]+) ([-r])', line)
if m.group(3) == 'r': # if this is a readable region
start = int(m.group(1), 16)
end = int(m.group(2), 16)
mem_file.seek(start) # seek to region start
chunk = mem_file.read(end - start) # read region contents
print chunk, # dump contents to standard output
maps_file.close()
mem_file.close()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment