On Windows, I can use tools like Process Explorer and Process Hacker to view in-memory strings generated at runtime of a given process. How can I accomplish this same task on Ubuntu?


You can use gcore utility to generate the core dump which can be examined with gdb debugger (or strings utility) and should contain the full memory image.


Another way to read a process's memory in Linux isto read the psaudo-file /proc/<PID>/mem, which provides raw access to the memory space, as seen by the process, at offsets retrieved from /proc/<PID>/maps, which provides information about how the memory is laid out.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.