Skip to content

Instantly share code, notes, and snippets.

@KeyboardInterrupt

KeyboardInterrupt/memdump.py

Forked from Dbof/memdump.py
Last active May 31, 2022 10:35
Show Gist options
  • Save KeyboardInterrupt/9aecd53bb36bd4146ba550f15c10da03 to your computer and use it in GitHub Desktop.
Save KeyboardInterrupt/9aecd53bb36bd4146ba550f15c10da03 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. KeyboardInterrupt revised this gist May 31, 2022. 1 changed file with 13 additions and 9 deletions.
    22 changes: 13 additions & 9 deletions memdump.py
    View file
    Original file line number Diff line number Diff line change
    @@ -18,18 +18,22 @@
    out_file = f'{pid}.dump'

    # iterate over regions
    with open(map_file, 'r') as map_f, open(mem_file, 'rb', 0) as mem_f, open(out_file, 'wb') as out_f:
    with open(map_file, 'r') as map_f, open(mem_file, 'rb', 0) as mem_f:
    with open(f'{pid}.map','w') as map_f_out:
    map_f_out.write(map_f.read())
    map_f.seek(0)
    for line in map_f.readlines(): # for each mapped region
    m = re.match(r'([0-9A-Fa-f]+)-([0-9A-Fa-f]+) ([-r])', line)
    if m.group(3) == 'r': # readable region
    start = int(m.group(1), 16)
    end = int(m.group(2), 16)
    mem_f.seek(start) # seek to region start
    print(hex(start), '-', hex(end))
    try:
    chunk = mem_f.read(end - start) # read region contents
    out_f.write(chunk) # dump contents to standard output
    except OSError:
    print(hex(start), '-', hex(end), '[error,skipped]', file=sys.stderr)
    continue
    print(f'Memory dump saved to {out_file}')
    print(f"{hex(start)}-{hex(end)}")
    with open(f'{pid}_{hex(start)}-{hex(end)}.dump', 'wb') as out_f:
    try:
    chunk = mem_f.read(end - start) # read region contents
    out_f.write(chunk) # dump contents to standard output
    except OSError:
    print(hex(start), '-', hex(end), '[error,skipped]', file=sys.stderr)
    continue
    print(f'Memory dump saved to {out_file}')
  2. @Dbof Dbof revised this gist Mar 26, 2021. No changes.
  3. @Dbof Dbof created this gist Mar 26, 2021.
    35 changes: 35 additions & 0 deletions memdump.py
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,35 @@
    #! /usr/bin/env python3
    import sys
    import re

    if __name__ == "__main__":

    if len(sys.argv) != 2:
    print('Usage:', sys.argv[0], '<process PID>', file=sys.stderr)
    exit(1)

    pid = sys.argv[1]

    # maps contains the mapping of memory of a specific project
    map_file = f"/proc/{pid}/maps"
    mem_file = f"/proc/{pid}/mem"

    # output file
    out_file = f'{pid}.dump'

    # iterate over regions
    with open(map_file, 'r') as map_f, open(mem_file, 'rb', 0) as mem_f, open(out_file, 'wb') as out_f:
    for line in map_f.readlines(): # for each mapped region
    m = re.match(r'([0-9A-Fa-f]+)-([0-9A-Fa-f]+) ([-r])', line)
    if m.group(3) == 'r': # readable region
    start = int(m.group(1), 16)
    end = int(m.group(2), 16)
    mem_f.seek(start) # seek to region start
    print(hex(start), '-', hex(end))
    try:
    chunk = mem_f.read(end - start) # read region contents
    out_f.write(chunk) # dump contents to standard output
    except OSError:
    print(hex(start), '-', hex(end), '[error,skipped]', file=sys.stderr)
    continue
    print(f'Memory dump saved to {out_file}')