how dump a program which is running in memory

Gerhard Häring gh at ghaering.de
Thu Sep 11 13:48:53 CEST 2008


ruqiang826 wrote:
> hi
> I have written a service running backgroud to do something in linux.
> unfortunately,I deleted the source code by mistake, and I can still
> see the process running background using "ps aux" :
> 
> username   13820  0.0  0.0 60368 2964 ?        S    Aug20   0:33
> python ./UpdateJobStatus.py
> 
> 
> I wonder if there is some way to dump the programme
> "UpdateJobStatus.py" and get the source code back?

Often, there is a way by accessing /proc/{pid}/fd/

But I believe you're out of luck with this method because apparently the 
Python interpreter closes the source file after parsing it.

You can still try to find an undeletion utility for your filesystem. 
Avoid writing to disk in the meantime to not overwrite the deleted file 
accidentally, of course. There's such a utility for ext2, but I don't 
know if that works ok with ext3. For other filesystems, I have no idea.

-- Gerhard




More information about the Python-list mailing list