A Blog on digital investigations

Posts tagged "Linux":

Dump Linux process memory


If you need to acquire the process memory of a process running on a Linux system, you can use gcore 1 to create a core file or, alternatively, retrieve its memory areas from /proc/<PID>/maps and use GDB 2 itself to dump the content into a file. For a convenient way to do this, refer to a basic shell script hosted as a gist named dump_pmem.sh 3.

Other posts