Dump a linux process’s memory to file

I’m not sure how you dump all the memory to a file without doing this repeatedly (if anyone knows an automated way to get gdb to do this please let me know), but the following works for any one batch of memory assuming you know the pid: 

$ cat /proc/[pid]/maps

This will be in the format (example): 

00400000-00421000 r-xp 00000000 08:01 592398                             /usr/libexec/dovecot/pop3-login
00621000-00622000 rw-p 00021000 08:01 592398                             /usr/libexec/dovecot/pop3-login
00622000-0066a000 rw-p 00622000 00:00 0                                  [heap]
3e73200000-3e7321c000 r-xp 00000000 08:01 229378                         /lib64/ld-2.5.so
3e7341b000-3e7341c000 r--p 0001b000 08:01 229378                         /lib64/ld-2.5.so

Pick one batch of memory (so for example 00621000-00622000) then use gdb as root to attach to the process and dump that memory: 

$ gdb --pid [pid]
(gdb) dump memory /root/output 0x00621000 0x00622000

Then analyse /root/output with the strings command, less you want the PuTTY all over your screen.

Related Posts:

  1. What does pss mean in /proc/pid/smaps
  2. Python subprocess.Popen “OSError: [Errno 12] Cannot allocate memory”
  3. -bash: fork: Cannot allocate memory
  4. Difference between exec, execvp, execl, execv?
  5. Environment variables of a running process on Unix?
  6. Meaning of the buffers/cache line in the output of free
  7. What does Virtual memory size in top mean?
  8. Keeping a linux process running after I logout
  9. How to get pid of just started process
  10. Why drop caches in Linux?
  11. How to sort ps output by process start time?
  12. In Linux, what is the difference between “buffers” and “cache” reported by the free command?
  13. How do I deal with a filename that starts with the hyphen (-) character?
  14. What’s a .sh file?
  15. How can I symlink a file in Linux? [closed]
  16. How to fix ‘sudo: no tty present and no askpass program specified’ error?
  17. Kill detached screen session [closed]
  18. How do I grep recursively?
  19. How to get the url of the current svn repo?
  20. apt-get error: Sub-process /usr/bin/dpkg returned an error code (1)
  21. performing HTTP requests with cURL (using PROXY)
  22. How do I grep recursively?
  23. How to perform grep operation on all files in a directory?
  24. Amazon Linux: apt-get: command not found
  25. How to extract C source code from .so file?
  26. Pass a password to ssh in pure bash
  27. How to substitute shell variables in complex text files
  28. “sed” command in bash
  29. gcc: error: unrecognized command line option
  30. How to exclude a directory in find . command
  31. How can I find all *.js file in directory recursively in Linux?
  32. How to set proxy for wget?
  33. Argument list too long error for rm, cp, mv commands
  34. How to change permissions for a folder and its subfolders/files in one step
  35. Difference between using “chmod a+x” and “chmod 755”
  36. ssh: Could not resolve hostname [hostname]: nodename nor servname provided, or not known
  37. Docker can’t connect to docker daemon
  38. Need a good hex editor for Linux
  39. How to open some ports on Ubuntu?
  40. Given two directory trees, how can I find out which files differ by content?
  41. What does it mean to mount a file system in linux?
  42. Trying to use bash on Windows and got no installed distributions message
  43. “Unable to find remote helper for ‘https'” during git clone
  44. What is the difference between “#!/usr/bin/env bash” and “#!/usr/bin/bash”?
  45. Is there a “goto” statement in bash?
  46. Explanation of polkitd Unregistered Authentication Agent
  47. Bash script: bad interpreter
  48. tar: Cowardly refusing to create an empty archive
  49. How can I delete a user in linux when the system says its currently used in a process
  50. Command to change the default home directory of a user
  51. Read and write to binary files in C?
  52. PHP and mod_fcgid: ap_pass_brigade failed in handle_request_ipc function
  53. How to grep and replace
  54. What does “&” at the end of a linux command mean?
  55. Can’t remove a directory in Unix
  56. How to recursively download a folder via FTP on Linux
  57. C fopen vs open
  58. httpd: Could not reliably determine the server’s fully qualified domain name, using 127.0.0.1 for ServerName
  59. Why does “docker attach” hang?
  60. Retrieve last 100 lines logs
  61. What are various options / arguments for “./configure” in Linux
  62. How to include file in a bash shell script
  63. Does Mac OS X use Linux?
  64. CronJob not running
  65. Delete .DS_STORE files in current folder and all subfolders from command line on Mac
  66. bash sh – command not found 
  67. Hosting multiple WordPress sites on single server – best practices?
  68. How to configure WP filesystem access in Linux (Ubuntu Server)?
  69. Can’t upload media to my Raspberry Pi WordPress server
  70. My WordPress is giving me an 403 error when saving post/draft with specific words
  71. Anyone else experiencing high rates of Linux server crashes during a leap second day?
  72. What permissions should my website files/folders have on a Linux webserver?
  73. Can I automatically add a new host to known_hosts?
  74. Can I nohup/screen an already-started process?
  75. How can I run Debian stable but install some packages from testing?
  76. In my /etc/hosts/ file on Linux/OSX, how do I do a wildcard subdomain?
  77. Shell command to monitor changes in a file
  78. How to cd into a directory with this name “-2” (starting with the hyphen)?
  79. how to disable SSH login with password for some users?
  80. Difference in sites-available vs sites-enabled vs conf.d directories (Nginx)?
  81. Is it possible to detach a process from its terminal? (Or, “I should have used screen!”) [duplicate]
  82. Disk full, du tells different. How to further investigate?
  83. Filename length limits on linux?
  84. best way to clear all iptables rules
  85. How can I port forward with iptables?
  86. Why do we use a OS Base Image with Docker if containers have no Guest OS?
  87. How can I rename a Unix user?
  88. How to re-order windows, change the scroll shortcut, and modify the status bar contents in GNU Screen?
  89. How to make Windows 7 USB flash install media from Linux?
  90. How to install/change locale on Debian?
  91. What limits the maximum number of connections on a Linux server?
  92. How to prevent a user from login in, but allow “su – user” in Linux?
  93. I have a keypair. How do I determine the key length?
  94. How to do the port forwarding from one ip to another ip in same network?
  95. Linux – Is there a way to prevent/protect a file from being deleted even by root?
  96. swap partition vs file for performance?
  97. Best way to disable swap in Linux
  98. How to remove invalid characters from filenames?
  99. How do I join two named pipes into single input stream in linux
  100. How should an IT department choose a standard Linux distribution?

Leave a Comment