Saturday, February 09, 2013

Dumping process memory in Linux

Sometimes when troubleshooting misbehaving applications having complete dump of process memory comes handy. Here's small script that does exactly that on Linux. Run it with pid of process you're interested as parameter.



Source: http://serverfault.com/questions/173999/dump-a-linux-processs-memory-to-file


#!/bin/bash

grep rw-p /proc/$1/maps | sed -n 's/^\([0-9a-f]*\)-\([0-9a-f]*\) .*$/\1 \2/p' | while read start stop; do gdb --batch --pid $1 -ex "dump memory $1-$start-$stop.dump 0x$start 0x$stop"; done

No comments:

Post a Comment

Got something to say?!