On Windows, I can use tools like Process Explorer and Process Hacker to view in-memory strings generated at runtime of a given process. How can I accomplish this same task on Ubuntu?

up vote 2 down vote accepted

You can use gcore utility to generate the core dump which can be examined with gdb debugger (or strings utility) and should contain the full memory image.

Another way to read a process's memory in Linux isto read the psaudo-file /proc/<PID>/mem, which provides raw access to the memory space, as seen by the process, at offsets retrieved from /proc/<PID>/maps, which provides information about how the memory is laid out.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.