memory dumper :D

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
<?php
ini_set('memory_limit', '1024M');
$pid = 19677;
$maps_raw = file_get_contents("/proc/$pid/maps");
preg_match_all("/([a-f0-9]+)\-([a-f0-9]+) ([\-a-z]+) ([a-f0-9]+) ([a-f0-9]{2})\:([a-f0-9]{2}) (\d+)([^\n]+)/si", $maps_raw, $maps);
$fp = fopen("/proc/$pid/mem", "r");
$total_maps = count($maps[0]);
$is_start_image = false;
$last_image_name = NULL;
$lfp = NULL;
for ($i = 0; $i < $total_maps; ++$i) {
$image = trim($maps[8][$i]);
// echo $image."\n";
$start = hexdec($maps[1][$i]);
$end = hexdec($maps[2][$i]);
if ($maps[7][$i] > 0) {
if (!$is_start_image) {
if (preg_match("/dsetup\.dll/i", $image)) {
$is_start_image = true;
}
} else
break;
}
if ($maps[3][$i] == "---p") continue;
if ($is_start_image) {
$f = "dsetup_".$maps[1][$i]."-".$maps[2][$i].".dll";
$lfp = fopen($f, "w+");
fseek($fp, $start);
fwrite($lfp, fread($fp, $end - $start + 1));
echo "$f (".$maps[1][$i]."-".$maps[2][$i]." ".$maps[3][$i].") = ".(($end - $start + 1) / 1024)."\n";
fclose($lfp);
}
}
/*
unset($maps[0]);
var_dump($maps);
//15080000-15081000 r-xp 00000000 08:01 22285127 /home/azq2/l2/averia.ws/system/dsetup.dll
$fp = fopen("/proc/14435/mem", "r");
fseek($fp, 0x15080000);
// echo "".fread($fp, 0x15081000 - 0x15080000 + 1)."";
echo 0x15081000 - 0x15080000;
// 0x15080000 0x15081000
*/