Linked Questions
26 questions linked to/from How do I read from /proc/$pid/mem under Linux?
12 votes
1 answer
72k views
How to find Heap memory of a running process? [duplicate]
I would like to know how to find the heap memory of a process that is running in the background. Is there any command that allows such?
1 vote
1 answer
534 views
Replacement for TCT's pcat utility [duplicate]
I am looking for a utility to dump the memory of a running process that I can then examine for strings. In the past I have used pcat from The Coroner's Toolkit, but I am having a hard time finding a ...
22 votes
4 answers
23k views
How to re-load all running applications from swap space into RAM?
If my desktop run out of memory and swaps a lot then I free or kill the application wasting my RAM. But, after that, all my desktop/applications have been swapped and are horribly slow, do you know a ...
36 votes
5 answers
7k views
Making Linux read swap back into memory
The Linux kernel swaps out most pages from memory when I run an application that uses most of the 16GB of physical memory. After the application finishes, every action (typing commands, switching ...
30 votes
5 answers
12k views
Suspend/resume single process to/from disk
On occasion, we would like to suspend memory-intensive processes on our Ubuntu and OS X servers to temporarily free up some RAM for other jobs. If all we were worried about was CPU usage, a simple ...
17 votes
5 answers
20k views
Special File that causes I/O error
I want to automatically test if a piece of software reacts as expected if an essential SQLite DB file fails to be read (causing an I/O error). Exactly that happened some days ago at a client. We ...
16 votes
3 answers
27k views
Exploring RAM contents
I am using a redis Database and would like to explore the contents of the RAM the application is using. I feel the explanation of why I want to do this will make more sense then the question I would ...
30 votes
4 answers
8k views
How can we know who's at the other end of a pseudo-terminal device?
If I do a: echo foo > /dev/pts/12 Some process will read that foo\n from its file descriptor to the master side. Is there a way to find out what that(those) process(es) is(are)? Or in other ...
10 votes
4 answers
25k views
kernel: disabling /dev/kmem and /dev/mem
I understand that /dev/kmem and /dev/mem provide access to the memory (i.e. raw RAM) of the system. I am also aware, that /dev/kmem can be completely disabled in kernel and that access can be ...
17 votes
5 answers
7k views
Read the stack of another process?
I'm trying to read a child process's stack but with no luck. I know it is possible using ptrace, but ptrace's interface allows you to read only one word at a time, and I'm trying to scan a larger ...
6 votes
4 answers
5k views
How do see the memory used by a program in ubuntu?
How can I see the raw memory data used by an application ? Like , suppose I have a file name something.sh . Now I run the command ./something.sh , and then I want see all the data its accessing in ram ...
6 votes
1 answer
11k views
How to set up gdb to scan through heap memory?
I want to print out and analyze the contents of the system heap. Obviously, this should be a privileged operation, and might go against the grain of what GDB was intended to do. Specifically, I want ...
6 votes
2 answers
6k views
Cross-process dup on Linux
I'd like to dup a file descriptor running in an unrelated process on Linux. I know about sendmsg(2) and SCM_RIGHTS (e.g. https://stackoverflow.com/questions/4489433/sending-file-descriptor-over-unix-...
5 votes
1 answer
6k views
Solution to get data from memory of a process
If I'm using Firefox and filling out a big form (with lots of text to write), and for some reason I accidentally press F5 and all my text in the forms is lost, I can use e.g. HxD on Windows to ...
11 votes
2 answers
2k views
how does fileless malware work on linux?
I understand the definition of fileless malware: Malicious code that is not file based but exists in memory only… More particularly, fileless malicious code … appends itself to an active process ...
2 votes
1 answer
5k views
how to see the contents in the RAM when a program is executed in Linux?
I want to see the contents of a program being stored in RAM when the program is executed . I have used cat /proc/[pid]/meminfo but it gave only address and permission mode details . I also tried ...
1 vote
2 answers
3k views
Is there way to force Linux to unswap when there is low CPU usage?
After working for more than a day on my machine, swap becomes about 1GB. Some of my panel plugins go to swap so they become laggy. Moreover, the system doesn't unswap until I make it to do it swapoff -...
4 votes
1 answer
2k views
Move application explicitly to swap
Is it possible in Linux/Unix systems, to move a process explicitly to the memory swap? I've investigated swap* tools and kill but they can't do anything I want. Example: Process FOO is currently ...
3 votes
1 answer
4k views
How to read files in the proc directory? [closed]
I found that ls command can't read file in `/proc' Please see the attachment. There are many link files ,but you can't read it by ls.
2 votes
1 answer
5k views
How to calculate heap size of process from address space?
I was trying to find the heap size my process is using. I did fgrep '[stack]' /proc/pid/maps and got 00a00000-45937000 rw-p 00000000 00:00 0 [heap] Now I wanted ...
0 votes
1 answer
2k views
Accessing memory of parent process from child process
Say I login using bash and I define an alias. $ alias c=clear $ echo $0 bash Now I enter dash. $ dash $ echo $0 dash The alias defined in bash isn't available: $ alias $ How do I access it? More ...
2 votes
0 answers
2k views
Read another processes memory using ptrace() in C/CPP [RaspberryPi]
So, initially, process A created a file containing data (37 Bytes) read from a stream(UART). Process B has to acquire that data, which is stored in /dev/shm. Process A has an absolute maximum of 4ms ...
1 vote
1 answer
419 views
How do I get linux-gate.dso on a newer linux system?
I would like to find out which method my 32bit QEMU guest is using for system calls. There's an excellent article explaining linux-gate.dso (http://www.trilithium.com/johan/2005/08/linux-gate/). ...
0 votes
1 answer
512 views
Missing main memory on Linux
On a new PC with 64 GB of main memory, I can only see about 60 GB, missing a whole 4 GB. In BIOS all four modules of 16 GB each can be seen, and also that it adds up to the expected 64 GB. But on ...
1 vote
1 answer
393 views
Copy of full swap file is empty
I use a swap file (/mnt/swap). The swap works right. I need to get an access to the data stored in. When it's full of data in some part (which I can see typing "free" in terminal), I copy the file to ...
0 votes
3 answers
190 views
How to get data shown out of workspace or directly from application?
Because of some reason I had to use another web browser than my main which I use daily and I chose a small browser which I installed long time ago. This brower is called Dooble, version 0.07 (dooble-0....