If I'm using Firefox and filling out a big form (with lots of text to write), and for some reason I accidentally press F5 and all my text in the forms is lost, I can use e.g. HxD on Windows to retrieve the text, because they're still in memory. How can I do the same under Linux? (e.g. Fedora)
Asked
Active
Viewed 5,362 times
5
-
I'm not sure what your title has to do with this; are you just looking for hex editor recommendations? Or do you want something that will dump the contents of memory? – Michael Mrozek May 25 '11 at 15:20
-
thx, updated title – LanceBaynes May 25 '11 at 15:23
1 Answers
7
I'd try something like this:
strings /proc/$PID/mem | grep $MYTEXT
Where $PID is process id of your running browser program and $MYTEXT is a substring of the text you remember typing in.
alex
- 7,093
- 6
- 28
- 30
-
good idea but: [root@g2 10653]# ls -lah /proc/10653/ | grep -i mem -rw-------. 1 USER USER 0 máj 25 20.29 mem [root@g2 10653]# – LanceBaynes May 25 '11 at 18:39
-
@LanceBaynes: This comment is meaningless. As it happens, I can guess that you saw an error message and misinterpreted it, but you should have copy-pasted the command you ran and the error message, not some random other command. Reading from `/proc/$PID/mem` is not straightforward, see [How do I read from /proc/$pid/mem under Linux?](http://unix.stackexchange.com/questions/6301/how-do-i-read-from-proc-pid-mem-under-linux). – Gilles 'SO- stop being evil' May 25 '11 at 22:08
-
ohh, thanks! I tried you're python script (you didn't wrote a small howto, how to parameter it, or how to use it?) I tried: http://pastebin.com/raw.php?i=ZeQs50g1 - Fedora14/bash – LanceBaynes May 26 '11 at 08:05