pcat(1)

pcat1

Copy process memory

Usage

pcat [-hHv] [-m mapfile] process_id

Overview

pcat hooks onto the process specified with process_id and copies the contents of its memory to standard output. By default, pcat skips over holes in the process address space. Consequently, absolute location information is lost.

Options:

-h (default)

Skip over holes in the process address space, so that absolute location information is lost.

-H

Preserve holes in the process address space, so that absolute location information is preserved. This option writes holes to the output file, and requires that stdout is redirected to file. This option does not work on some Solaris versions.

-m mapfile

Print the process memory map to mapfile, one entry per line. Specify -m- to write to the standard error stream. Each map entry consists of a region start address and the first address beyond that region. Addresses are separated by space, and are printed as hexadecimal numbers (0xhhhh).

-v

Enable verbose mode, for debugging purposes.

Author(s)

Wietse Venema
IBM T.J. Watson Research
P.O. Box 704
Yorktown Heights, NY 10598, USA

Releases

5 releases since Debian 3.0 (Woody); the text changed 1 time.

  1. 3.0–5.0
  2. 6.0

Bugs

On systems with a usable /proc file system, pcat does not stop the target process before accessing its memory. This can result in a loss of accuracy.

pcat uses ptrace(2) when the system lacks a usable /proc file system. This can be very, very, slow.

The use of ptrace(2) causes the target process to be stopped while its memory being is copied. This can be undesirable.

On some systems, the ptrace(2) detach operation resumes a process that was stopped prior to the ptrace(2) attach operation. pcat attempts to compensate by sending SIGSTOP signals when it detaches from the process.

On some systems, the ptrace(2) detach operation leaves a process stopped that was not stopped prior to the ptrace(2) attach operation. pcat attempts to compensate by sending a SIGCONT signal when it detaches from the process.

On most non-/proc systems, pcat accesses kernel data structures and therefore 1) needs super-user privilege and 2) must be compiled specifically for the machine that it runs on.

pcat will not copy its own memory.

pcat will not copy system processes (i.e. processes that live entirely inside the kernel).

History


    

    
        
This pcat command was written for the coroner's toolkit. However, a command with the same name exists on some versions of System V UNIX. That command, a file decompression utility, should not be confused with the command described in this manual page.

    


            

        
            

                
License

                
    
    
        
This software is distributed under the IBM Public License.

    


            

        
        

            From tct 1.19-1 in Debian 6.0 (Squeeze).
            
            Parsed by carta from the page's man source.