Tengo el siguiente código probado en algunas distribuciones de Linux (Debian, Linux Mint...) y funcionando, pero en CentOS recibo un error incluso cuando lo ejecuto como root:
#!/usr/bin/env python import re maps_file = open("/proc/18396/maps", 'r') mem_file = open("/proc/18396/mem", 'r', 0) for line in maps_file.readlines(): # for each mapped region m = re.match(r'([0-9A-Fa-f]+)-([0-9A-Fa-f]+) ([-r])', line) if m.group(3) == 'r': # if this is a readable region start = int(m.group(1), 16) end = int(m.group(2), 16) mem_file.seek(start) # seek to region start chunk = mem_file.read(end - start) # read region contents print chunk, # dump contents to standard output maps_file.close() mem_file.close()El script lee la memoria del proceso y vuelca la región legible. Bajo CentOS 5.4 x64 me sale el siguiente error:
Traceback (most recent call last): File "./mem.py", line 11, in ? chunk = mem_file.read(end - start) # read region contents IOError: [Errno 3] No such processEl proceso está vivo y legible:
[root@localhost ~]# ps xa|grep 18396 18396 ? S 0:00 /usr/sbin/httpd [root@localhost ~]# ls -al /proc/18396/maps && ls -al /proc/18396/mem -r--r--r-- 1 root root 0 Jan 31 17:26 /proc/18396/maps -rw------- 1 root root 0 Jan 31 17:26 /proc/18396/mem¿alguna idea? Lo probé en Python 2.4 y Python 2.7 funciona en distribuciones similares a Debian pero no en CentOS.
Encontré la respuesta yo mismo después de un poco de excavación:
#!/usr/bin/env python import ctypes, re, sys ## Partial interface to ptrace(2), only for PTRACE_ATTACH and PTRACE_DETACH. c_ptrace = ctypes.CDLL("libc.so.6").ptrace c_pid_t = ctypes.c_int32 # This assumes pid_t is int32_t c_ptrace.argtypes = [ctypes.c_int, c_pid_t, ctypes.c_void_p, ctypes.c_void_p] def ptrace(attach, pid): op = ctypes.c_int(16 if attach else 17) #PTRACE_ATTACH or PTRACE_DETACH c_pid = c_pid_t(pid) null = ctypes.c_void_p() err = c_ptrace(op, c_pid, null, null) if err != 0: raise SysError, 'ptrace', err pid = "18396" ptrace(True, int(pid)) maps_file = open("/proc/"+pid+"/maps", 'r') mem_file = open("/proc/"+pid+"/mem", 'r', 0) for line in maps_file.readlines(): # for each mapped region m = re.match(r'([0-9A-Fa-f]+)-([0-9A-Fa-f]+) ([-r])', line) if m.group(3) == 'r': # if this is a readable region start = int(m.group(1), 16) end = int(m.group(2), 16) mem_file.seek(start) # seek to region start chunk = mem_file.read(end - start) # read region contents print chunk, # dump contents to standard output maps_file.close() mem_file.close() ptrace(False, int(pid))