volatility icon indicating copy to clipboard operation
volatility copied to clipboard

Command for dumping process executable

Open saneehaAmir opened this issue 3 years ago • 0 comments

Hello, I want to dump a process executable from memory image of an android emulator. Currently i m using linux_procdump command for obtaining the dump and it is returning the dump file.

But i am unable to find this command in Linux volatility documentation at https://github.com/volatilityfoundation/volatility/wiki/Linux-Command-Reference

Please guide if the output i m getting in form of dump is correct or do I need to use some other commands in combination to get the dump of executable against a PID. Like linux_memmap, linux_proc_maps and linux_proc_maps.

Ill be grateful for your help.

Regards,

saneehaAmir avatar Jun 04 '22 05:06 saneehaAmir