[Python-Dev] Extracting python bytecode from a linux core dump?

Steve Dower steve.dower at python.org
Thu Jun 8 19:55:19 EDT 2017

I can’t help with the gdb commands, but I’d suggest you want to start from one of the global variables for the sys module, probably the modules dict. You’ll have to reverse engineer the memory structures to find its values and each of their dicts, eventually finding function objects pointing to code objects which will point to bytecode blobs. All of these structures are in the sources, so it shouldn’t be that hard, just time consuming (I’ve done it on Windows before with different tools).

If you know the code was being executed when the dump was made you could look at the stack to find calls in the EvalFrame function. Those should have a local or argument to the code object or bytecode (my memory on names and structures in 2.6 isn’t that good).

A final alternative would be to find the function type object address and search memory for that to locate function objects and then code objects. That might be the best one, if you can locate the type object in the dump.

Hope that helps,

Top-posted from my Windows phone

From: CompuTinker
Sent: Wednesday, June 7, 2017 13:26
To: python-dev at python.org
Subject: [Python-Dev] Extracting python bytecode from a linux core dump?

I hope this is the proper place for internals questions...

I have a core file (produced via the gcore command) of a linux python2.6 process.  I need to extract the byte code and de-compile it.

I looked at https://wiki.python.org/moin/DebuggingWithGdb and related pages.  
However, these all seem to require either a running process and/or a binary with debugging symbols.

I'm thinking that the compiled bytecode is likely in an array or contiguous set of memory within the python executable's image and that there's probably a way to pull it out with gdb.  Unsurprisingly, the pyc 0xd1f20d0a magic number isn't kept in memory. So, how do I find the memory holding the compiled byte-code ?

Python-Dev mailing list
Python-Dev at python.org
Unsubscribe: https://mail.python.org/mailman/options/python-dev/steve.dower%40python.org

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.python.org/pipermail/python-dev/attachments/20170608/a8022961/attachment.html>

More information about the Python-Dev mailing list