mem-dump
loads an ELF binary into the memory, sets a breakpoint at
the entrypoint of the ELF binary, and dumps all the registers and
memory after reaching the entrypoint.
Note: This only works on x86_64 linux system.
./mem-dump [-o OUTPUT-FILENAME] PROG [ARGS...]
Dumps to file mem.dump
by default.
./mem-dump ./mem-dump
./mem-dump echo nice
./mem-dump -o echo.dump echo nice
- Parses command-line arguments to figure out output filename.
- Checks to see if the binary needs to searched in PATH environment variable, if yes, then finds it.
- Parses the ELF binary to figure out binary’s entrypoint.
- Forks, and the child calls
ptrace(PTRACE_TRACEME, ...)
. - Child then calls
execve(PROC, ARGS...)
. - Parent parses the child’s
/proc/<pid>/maps
file, to find the entrypoint in the memory of the process. - Adds
0xCC
software interupt at the found memory address. - Continues the child until
0xCC
. - Corrects everythings back in the child.
- Dumps registers, and memory.
- Kills the child.
- Option parsing
- Resolving the binary pathname
- Parsing
/proc/<pid>/maps
- Rest
ptrace
related usagestrace and https://blog.tartanllama.xyz/writing-a-linux-debugger-setup/