Skip to content

Instantly share code, notes, and snippets.

@jo-makar

jo-makar/proc-mem.md

Last active October 17, 2019 20:02
Download ZIP

Revisions

  1. jo-makar revised this gist Oct 17, 2019. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion proc-mem.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,4 +1,4 @@
    # Read live process memory via /proc/$pid/mem
    # Read live process memory

    /proc/$pid/maps describes virtual memory regions with the first column being the address range

  2. jo-makar revised this gist Oct 17, 2019. 1 changed file with 2 additions and 2 deletions.
    4 changes: 2 additions & 2 deletions proc-mem.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,6 +1,6 @@
    # Read live process memory via /proc/$pid/mem

    /proc/<pid>/maps describes virtual memory regions with the first column being the address range
    /proc/$pid/maps describes virtual memory regions with the first column being the address range

    ```sh
    cd /proc/$pid/mem
    @@ -9,7 +9,7 @@ cd /proc/$pid/mem
    eval $(awk -F'[- ]' 'NR==1 {print "s="$1" e="$2}' maps)
    ```

    /proc/<pid>/mem provides access to the process' virtual memory
    /proc/$pid/mem provides access to the process' virtual memory

    ```sh
    python3 -c 'f=open("mem","rb"); f.seek(0x'$s'); (f.read(0x'$e'-0x'$s'))' | hexdump -C
  3. jo-makar revised this gist Oct 17, 2019. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion proc-mem.md
    View file
    Original file line number Diff line number Diff line change
    @@ -1,4 +1,4 @@
    # Read live process memory via /proc/<pid>/mem
    # Read live process memory via /proc/$pid/mem

    /proc/<pid>/maps describes virtual memory regions with the first column being the address range

  4. jo-makar created this gist Oct 17, 2019.
    16 changes: 16 additions & 0 deletions proc-mem.md
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,16 @@
    # Read live process memory via /proc/<pid>/mem

    /proc/<pid>/maps describes virtual memory regions with the first column being the address range

    ```sh
    cd /proc/$pid/mem

    # Extract the start and end address for the first entry (NR==1)
    eval $(awk -F'[- ]' 'NR==1 {print "s="$1" e="$2}' maps)
    ```

    /proc/<pid>/mem provides access to the process' virtual memory

    ```sh
    python3 -c 'f=open("mem","rb"); f.seek(0x'$s'); (f.read(0x'$e'-0x'$s'))' | hexdump -C
    ```