dumpram.py

   1 #! /usr/bin/env python
   2
   3 """Dumps RAM of a process."""
   4
   5 import re
   6 import sys
   7
   8 PID = sys.argv[1]
   9
  10 maps_file = open("/proc/%s/maps" % PID, 'r')
  11 mem_file = open("/proc/%s/mem" % PID, 'r', 0)
  12
  13 for line in maps_file.readlines():  # for each mapped region
  14     m = re.match(r'([0-9A-Fa-f]+)-([0-9A-Fa-f]+) ([-r])', line)
  15     if m.group(3) == 'r':  # if this is a readable region
  16         start = int(m.group(1), 16)
  17         end = int(m.group(2), 16)
  18         mem_file.seek(start)  # seek to region start
  19         chunk = mem_file.read(end - start)  # read region contents
  20         print chunk,  # dump contents to standard output
  21 maps_file.close()
  22 mem_file.close()