Binary Hacks - Dump process virtual memory

  1. get [pid] of process
  2. get the memory mappings cat /proc/[PID]/maps
  3. identify the memory range of interest
  4. connect gdb to pid and dump memory:
# perhaps need sudo

gdb --pid [PID] 
> dump memory <PATH-TO-DUMP-FILE> [START_ADDR] [END_ADDR]

Then you can exam the dump with tools like hexdump.

Oct 16, 2023