Author Topic: [Python] Dump process' memory using ptrace and procfs  (Read 565 times)

0 Members and 1 Guest are viewing this topic.

Offline Polyphony

  • VIP
  • Knight
  • *
  • Posts: 178
  • Cookies: 23
    • View Profile
[Python] Dump process' memory using ptrace and procfs
« on: August 12, 2015, 09:23:51 am »
I ran this fine on Xubuntu 15.04 with python-ptrace installed from the repos.

Code: (python) [Select]
#! /usr/bin/env python
from ptrace.debugger.debugger import PtraceDebugger
from ptrace.debugger.process import PtraceProcess
import sys

def ptrace(start, end, process):
    return process.readBytes(start, (end-start))

def dump(process):
    mapfile = open('/proc/{}/maps'.format(process.pid), 'r')
    start = 0
    end = 0
   
    # because regex is hard...
    for line in mapfile:
        line = line.split(' ')
        # don't try to poke the uninitialized and unreadable memory ya dingus
        # I'm actually not sure if this is important or not, I guess in some cases
        # you may want uninitialized memory?  idk
        if 'r' not in line[1] or int(line[4]) == 0:
            line = line[0].split('-')
            start = long(line[0], 16)
            end = long(line[1], 16)
            print(ptrace(start, end, process))
        else:
            continue
           
    mapfile.close()

def main(args):
    if len(args) < 2:
        print('usage: {} [pid]'.format(args[0]))
        return -1
   
    pid = int(args[1])
    dbg = PtraceDebugger()
    process = dbg.addProcess(pid, False)
   
    dump(process)
    dbg.quit()
    return 0
   
if __name__ == '__main__':
    sys.exit(main(sys.argv))

« Last Edit: August 12, 2015, 12:07:48 pm by techb »
Code: [Select]
<Spacecow_> for that matter I have trouble believing bitches are made out of ribs
<Gundilido> we are the revolutionary vanguard fighting for the peoples right to display sombrero dawning poultry
<Spacecow> did they see your doodle?
<~phage> Maybe
<+Unresolved> its just not creative enough for me
<+Unresolved> my imagination is to big to something so simple