CODEWITHSUNDEEP
pythonmemorypython-2.7
bsteo
bsteo

Reputation: 1779

Python read Linux process memory and dump to file

I have the following script:

import sys, os

pid = sys.argv[1]
maps_file = open("/proc/%s/maps" % pid, 'r')
mem_file = open("/proc/%s/mem" % pid, 'r')
for line in maps_file.readlines():  # for each mapped region
    m = re.match(r'([0-9A-Fa-f]+)-([0-9A-Fa-f]+) ([-r])', line)
    if m.group(3) == 'r':  # if this is a readable region
        start = int(m.group(1), 16)
        end = int(m.group(2), 16)
        mem_file.seek(start)  # seek to region start
        chunk = mem_file.read(end - start)  # read region contents
        #print chunk,  # dump contents to standard output
        mem_dump = open(pid+".bin", "wb")
        mem_dump.write(str(chunk,))
        mem_dump.close()
maps_file.close()
mem_file.close()

All workds well (dumping the process' memory) so far but I can't save data to file. What am I doing wrong?

Upvotes: 1

Views: 3667

Answers (1)

codebox
codebox

Reputation: 20254

Could it be that the files are getting written to somewhere you don't expect (looks like they will be written to the current directory)?

Upvotes: 1

Related Questions