Recovering text of Unsaved document from process memory? (frozen Xed window - process still "running" but in Sleeping status)
4
votes
0
answers
61
views
The window of my text editor Xed froze with Unsaved documents just as I was doing 'File'->'Save as...' to save them... [How ironic.]
Since the process still exists, I am trying to recover the text of those documents from the process memory (/proc/$pid/mem). [There was quite some text, thus the effort.]
I first tried through the following bash script based on
taken from this page :
#!/bin/bash
if [ -z "$1" ]; then
echo "Usage: $0 "
exit 1
fi
if [ ! -d "/proc/$1" ]; then
echo "PID $1 does not exist"
exit 1
fi
while read -r line; do
mem_range="$(echo "$line" | awk '{print $1}')"
perms="$(echo "$line" | awk '{print $2}')"
if [[ "$perms" == *"r"* ]]; then
start_addr="$(echo "$mem_range" | cut -d'-' -f1)"
end_addr="$(echo "$mem_range" | cut -d'-' -f2)"
echo "Reading memory range $mem_range..."
dd if="/proc/$1/mem" of="/dev/stdout" bs=1 skip="$((16#$start_addr))" count="$((16#$end_addr - 16#$start_addr))" 2>/dev/null
fi
done < "/proc/$1/maps"
The script outputs some data, however I am dubious about the approach because:
- I get this error/warning message due to the
part: : /proc/4063214/mem: cannot skip to specified offset
and I have then read somewhere that since /proc/$pid/mem
is a virtual file it cannot be skipped.
- The first comment in this post says that
cannot be used, however... (i) the comment is quite ancient by now, so I am wondering if it is still valid, (ii) despite the skip to specified offset
warning message from
it appears that shifting the offset value shifts the output accordingly, and (iii) with
I recover the same data as with
mentioned in this other answer ). So, should
be working in the end?
- Still under the same post, someone mentioned the
command which can generate a 'core file' of a process. Howerver, I am not sure what is a 'core file' and if this is what I need.
My questions are:
- Is using the
command as in the script above a valid path in the end?
- Should I rather stick to the Python-based approach proposed in this post mentioned above? (Or some other method like the gcore command?)
- Would there be some alternative path to my issue using other files from the '/proc/$pid' folder of Xed?
Asked by The Quark
(402 rep)
Jun 19, 2025, 01:47 PM
Last activity: Jun 19, 2025, 03:25 PM
Last activity: Jun 19, 2025, 03:25 PM