Python read Linux process memory and dump to file

Question

I have the following script:

import sys, os

pid = sys.argv[1]
maps_file = open("/proc/%s/maps" % pid, 'r')
mem_file = open("/proc/%s/mem" % pid, 'r')
for line in maps_file.readlines():  # for each mapped region
    m = re.match(r'([0-9A-Fa-f]+)-([0-9A-Fa-f]+) ([-r])', line)
    if m.group(3) == 'r':  # if this is a readable region
        start = int(m.group(1), 16)
        end = int(m.group(2), 16)
        mem_file.seek(start)  # seek to region start
        chunk = mem_file.read(end - start)  # read region contents
        #print chunk,  # dump contents to standard output
        mem_dump = open(pid+".bin", "wb")
        mem_dump.write(str(chunk,))
        mem_dump.close()
maps_file.close()
mem_file.close()

All workds well (dumping the process' memory) so far but I can't save data to file. What am I doing wrong?

what happens? do you get an error?

codebox
– codebox

2013-04-17 12:39:45 +00:00
Commented Apr 17, 2013 at 12:39 — codebox
– codebox, Commented Apr 17, 2013 at 12:39
no error, but no file written at all :-|

bsteo
– bsteo

2013-04-17 12:40:18 +00:00
Commented Apr 17, 2013 at 12:40 — bsteo
– bsteo, Commented Apr 17, 2013 at 12:40

codebox · Accepted Answer · 2013-04-17 12:44:59Z

1

Could it be that the files are getting written to somewhere you don't expect (looks like they will be written to the current directory)?

answered Apr 17, 2013 at 12:44

codebox

20.3k10 gold badges70 silver badges81 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

bsteo Over a year ago

Yeah, you are right, I expected to be written in the current directory but they didn't, with full path they are written, thanks!

bsteo Over a year ago

But still a problem, the file gets written with only a chunk not all data, any idea why? SOLVED: mem_dump = open("/tmp/%s.bin"%pid, "ab")

Wessie Over a year ago

@xtmtrx You could also keep the file open for the full for loop.

Collectives™ on Stack Overflow

Python read Linux process memory and dump to file

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related