I have a Ubuntu 18.04 memory dump (entire RAM), and while I was acquiring it with LiME, I had a Python program running. Using Volatility, I want to recover its data structure values which are located in Python program process heap. The linux_proc_map plugin gave me the virtual addresses I should be looking through.
For now, I am trying to find out how CPython PyObjects appear in memory, but I'm not sure what values to look for, so scanning for specific values will be difficult. I only know the name of the data structure...
Has anyone else on here tried to recover program data structures from process memory?
