Linux Memory Kung Foo

[Josh Coates]

>I was thinking something like strace that I could attach to the
>process, and look at all the memory segments of that running process..

if i understand you correctly, the process is no longer running and is no
longer in the process table.

if this is the case, i believe you are pretty much hosed.  the memory
associated with the process is probably on some queue somewhere waiting to
be recycled, and i am not aware of any way to access arbitrary physical
memory pages - though in the future you could hack the kernel to provide a
relatively simple syscall that would allow you to do this - but that won't
help you in your current situation.  :-(

Josh Coates
http://www.jcoates.org

-----Original Message-----
From: plug-bounces at plug.org [mailto:plug-bounces at plug.org]On Behalf Of
Matthew Frederico
Sent: Friday, February 04, 2005 8:19 AM
To: plug at plug.org
Subject: Re: Linux Memory Kung Foo


I was thinking something like strace that I could attach to the
process, and look at all the memory segments of that running process..




On Fri, 4 Feb 2005 09:06:19 -0600, Matthew Frederico
<mfrederico at gmail.com> wrote:
> We have a developer here who deleted a running program (php) and we
> were wondering if there was any way to get the PHP code from memory or
> if it is "gone"... I know back in old dos days you were able to poke
> around in memory ... Anybody know of such tools in Linux?
>
>
> --
> -- Matthew Frederico
> http://www.ultrize.com
>


--
-- Matthew Frederico
http://www.ultrize.com
.===================================.
| This has been a P.L.U.G. mailing. |
|      Don't Fear the Penguin.      |
|  IRC: #utah at irc.freenode.net   |
`==================================='