|
|
|
|
|
by BobbyTables2
741 days ago
|
|
I fully agree, and the approach of relying on the original ELF file headers of any kind seems very strange to me. When a memory dump is taken, the program could have dynamically allocated memory, which will always be in segments of memory outside those described by the ELF file. (Even before main() executes) The approach also ignores dynamic libraries loaded, and also won’t handle a relocatable ELF. One really has to look at /proc/PID/maps to see the actual memory ranges used by the process. |
|