memfetch - Linux on-demand process image dump
---------------------------------------------

Copyright (C) 2002, 2003, 2026 by Michal Zalewski <lcamtuf@coredump.cx>

Memfetch is a simple utility that can be used to dump the memory of any
live user space process without affecting its execution.

Simple demo:

  ./memfetch $$

The tool can be used to recover data (e.g., capture documents or screen
contents of non-responsive programs), to more conveniently search for
memory artifacts using command-line tools, to quickly peek into the state of
applications that use anti-debugging features, and so forth.

The tool can be also instructed to wait until a fault condition such as
SIGSEGV before dumping memory (-s). This function is useful for debugging
processes that are running in privileged contexts, have custom signal
handlers, or otherwise don't produce normal core dumps.

For completeness, you can instruct the tool to also dump read-only mapped
files (-a); most of the time, this will just contain sections of the
original binary and .so files. Finally, you can ask memfetch to only dump
the section containing a specific hex address (-A xxx) if you have a very
specific itch to scratch.

I originally wrote memfetch back in 2002. I revised the codebase to work on
modern 64-bit systems in 2026.

Change log:
-----------

  2026-06-01 (1.02):

    - Fixed typos, as suggested by Raj Vengalil and Lion Country.

  2026-05-31 (1.01):

    - Improved logic for writable file maps (now dumped by default),

    - Improved file naming conventions for output files,

    - Renamed options (-s to -a, -S to -A).

  2026-05-30 (1.00):

    - Substantially rewritten to support modern 64-bit Linux systems,

    - Removed old workarounds for kernel crashes on Linux 2.2,

    - Removed the option to write index data to stdout.

  2002-??-??:

    - Initial release.
