Sample Header Ad - 728x90

Recovering text of Unsaved document from process memory? (frozen Xed window - process still "running" but in Sleeping status)

4 votes
0 answers
61 views
The window of my text editor Xed froze with Unsaved documents just as I was doing 'File'->'Save as...' to save them... [How ironic.] Since the process still exists, I am trying to recover the text of those documents from the process memory (/proc/$pid/mem). [There was quite some text, thus the effort.] I first tried through the following bash script based on
taken from this page :
#!/bin/bash

if [ -z "$1" ]; then
  echo "Usage: $0 "
  exit 1
fi
if [ ! -d "/proc/$1" ]; then
  echo "PID $1 does not exist"
  exit 1
fi

while read -r line; do
  mem_range="$(echo "$line" | awk '{print $1}')"
  perms="$(echo "$line" | awk '{print $2}')"

  if [[ "$perms" == *"r"* ]]; then
    start_addr="$(echo "$mem_range" | cut -d'-' -f1)"
    end_addr="$(echo "$mem_range" | cut -d'-' -f2)"

    echo "Reading memory range $mem_range..."
    dd if="/proc/$1/mem" of="/dev/stdout" bs=1 skip="$((16#$start_addr))" count="$((16#$end_addr - 16#$start_addr))" 2>/dev/null
  fi
done < "/proc/$1/maps"
The script outputs some data, however I am dubious about the approach because: - I get this error/warning message due to the
part:
: /proc/4063214/mem: cannot skip to specified offset
and I have then read somewhere that since
/proc/$pid/mem
is a virtual file it cannot be skipped. - The first comment in this post says that
cannot be used, however... (i) the comment is quite ancient by now, so I am wondering if it is still valid, (ii) despite the
skip to specified offset
warning message from
it appears that shifting the offset value shifts the output accordingly, and (iii) with
I recover the same data as with
mentioned in this other answer ). So, should
be working in the end? - Still under the same post, someone mentioned the
command which can generate a 'core file' of a process. Howerver, I am not sure what is a 'core file' and if this is what I need. My questions are: - Is using the
command as in the script above a valid path in the end? - Should I rather stick to the Python-based approach proposed in this post mentioned above? (Or some other method like the gcore command?) - Would there be some alternative path to my issue using other files from the '/proc/$pid' folder of Xed?
Asked by The Quark (402 rep)
Jun 19, 2025, 01:47 PM
Last activity: Jun 19, 2025, 03:25 PM