From owner-freebsd-questions@FreeBSD.ORG  Sun Aug 24 21:51:47 2003
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 5BE4216A4BF
	for <freebsd-questions@freebsd.org>;
	Sun, 24 Aug 2003 21:51:47 -0700 (PDT)
Received: from pop018.verizon.net (pop018pub.verizon.net [206.46.170.212])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 68F4143FE5
	for <freebsd-questions@freebsd.org>;
	Sun, 24 Aug 2003 21:51:43 -0700 (PDT)
	(envelope-from leblanc@keyslapper.org)
Received: from keyslapper.org ([151.203.42.168]) by pop018.verizon.net
          (InterMail vM.5.01.05.33 201-253-122-126-133-20030313) with ESMTP
          id <20030825045142.YUVN11703.pop018.verizon.net@keyslapper.org>
          for <freebsd-questions@freebsd.org>;
          Sun, 24 Aug 2003 23:51:42 -0500
Received: from keyslapper.org (localhost [127.0.0.1])
	by keyslapper.org (8.12.8p1/8.12.8) with ESMTP id h7P4plDd048032
	for <freebsd-questions@freebsd.org>;
	Mon, 25 Aug 2003 00:51:47 -0400 (EDT)
	(envelope-from leblanc@keyslapper.org)
Received: (from leblanc@localhost)
	by keyslapper.org (8.12.8p1/8.12.8/Submit) id h7P4plP8048031
	for freebsd-questions@freebsd.org;
	Mon, 25 Aug 2003 00:51:47 -0400 (EDT)
Date: Mon, 25 Aug 2003 00:51:46 -0400
From: Louis LeBlanc <leblanc+freebsd@keyslapper.org>
To: freebsd-questions@freebsd.org
Message-ID: <20030825045146.GA47841@keyslapper.org>
Mail-Followup-To: freebsd-questions@freebsd.org
References: <0AF1BBDF1218F14E9B4CCE414744E70F1F3E83@exchange.wanglobal.net>
Mime-Version: 1.0
Content-Type: text/plain; charset=unknown-8bit
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <0AF1BBDF1218F14E9B4CCE414744E70F1F3E83@exchange.wanglobal.net>
User-Agent: Mutt/1.5.4i
X-Authentication-Info: Submitted using SMTP AUTH at pop018.verizon.net from
	[151.203.42.168] at Sun, 24 Aug 2003 23:51:42 -0500
Subject: Re: Dumping/reading memory space of a running program.
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
Reply-To: freebsd-questions@freebsd.org
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 25 Aug 2003 04:51:47 -0000

On 08/25/03 02:36 AM, Sten Daniel S?rsdal sat at the `puter and typed:
> 
>  How do i read/dump the entire memory space of a running program?
>  Is this possible?
>  I really dont have the option of restarting it. 

If you have access to all the structures in the process, you could
whip up a perl script that parses the output of nm(1) and parse the
/proc/filesystem for the process to pick and choose the data points
you want to see.

I've seen (and done, to an extent) the same thing on Solaris, and for
data structures that aren't too complex , it's not too tough.
Depending on the system, 2 levels of member structures gets a bit deep
to get through a big store.

You'll need to really read up on the procfs(5), nm(1), and the seek,
sysread, and unpack commands in perl to get it to work.

HTH
Lou
-- 
Louis LeBlanc               leblanc@keyslapper.org
Fully Funded Hobbyist, KeySlapper Extrordinaire :)
http://www.keyslapper.org                     ԿԬ

innovate, v.:
  To annoy people.