>I was thinking something like strace that I could attach to the >process, and look at all the memory segments of that running process..
if i understand you correctly, the process is no longer running and is no longer in the process table. if this is the case, i believe you are pretty much hosed. the memory associated with the process is probably on some queue somewhere waiting to be recycled, and i am not aware of any way to access arbitrary physical memory pages - though in the future you could hack the kernel to provide a relatively simple syscall that would allow you to do this - but that won't help you in your current situation. :-( Josh Coates http://www.jcoates.org -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Behalf Of Matthew Frederico Sent: Friday, February 04, 2005 8:19 AM To: [email protected] Subject: Re: Linux Memory Kung Foo I was thinking something like strace that I could attach to the process, and look at all the memory segments of that running process.. On Fri, 4 Feb 2005 09:06:19 -0600, Matthew Frederico <[EMAIL PROTECTED]> wrote: > We have a developer here who deleted a running program (php) and we > were wondering if there was any way to get the PHP code from memory or > if it is "gone"... I know back in old dos days you were able to poke > around in memory ... Anybody know of such tools in Linux? > > > -- > -- Matthew Frederico > http://www.ultrize.com > -- -- Matthew Frederico http://www.ultrize.com .===================================. | This has been a P.L.U.G. mailing. | | Don't Fear the Penguin. | | IRC: #utah at irc.freenode.net | `===================================' .===================================. | This has been a P.L.U.G. mailing. | | Don't Fear the Penguin. | | IRC: #utah at irc.freenode.net | `==================================='
