On 11/3/06, Andrew Shewmaker <agshew@xxxxxxxxx> wrote:
On 10/31/06, Arun Babu <arunbabu.n@xxxxxxxxx> wrote:
> Hi,
> We have /proc/[pid]/maps or pmap for displaying the memory mapping for a
> particular process.
> Do we have a way to see the snap shot of what is currently in the memory?(a
> total snapshot!)
> (say 0x... to 0x... shared library,
> 0x... to 0x... process i, etc..)
Exmap "... allows you to examine a complex system of processes and
determine the effective memory usage of each process, mapped file, ELF
section and ELF symbol, which can be helpful in memory optimisation
work."
http://www.berthels.co.uk/exmap/
Here's a paper, along with a kernel module, that can also do what you
have asked about.
The module is for a 2.4 kernel.
http://www.usenix.org/event/usenix05/tech/freenix/full_papers/movall/movall_html/index.html
A paper concerning RAM forensics on Linux, along with some Perl scripts.
http://cisr.nps.edu/downloads/theses/06thesis_urrea.pdf
There's also this gmemusage, which might be interesting to look at.
Debian has a package with patches for the 2.6 kernel.
http://oss.sgi.com/projects/gmemusage/
http://packages.debian.org/unstable/utils/gmemusage
And statifier is a neat tool that manipulates executable and its libraries
in ways you might find interesting. It uses gdb to grab a snapshot of
a process and all of its libraries and creates a new executable.
http://statifier.sf.net
--
Andrew Shewmaker
--
"You just have to keep breathing. Because the sun will rise. And you never know what the tide will bring in" -- Chuck Noland :)
visit: http://www4.ncsu.edu/~abnagara
