#!/usr/bin/ruby require 'metasm' dfp = Metasm::OS.current.find_process('warf') abort 'no running df found' if not dfp heapinfo = dfp.mappings.find_all { |a, l, *i| i[1] =~ /heap/ } puts "[*] found #{heapinfo.length} heaps" heaps = {} heapinfo.each { |a, l, p, i| heaps[a] = dfp.memory.get_page(a, l) puts "[*] mirrored #{'%x' % a}" } heaps.each { |k, v| File.open("heap_#{k.to_s(16)}.raw", 'wb') { |fd| fd.write v } }