Content-type: text/html Manpage of PCAT

PCAT

Section: User Commands (1)
Index Return to Main Contents

NAME

pcat - copy process memory

SYNOPSIS

pcat [-hHv] [-m mapfile] process_id

DESCRIPTION

pcat hooks onto the process specified with process_id and copies the contents of its memory to standard output. By default, pcat skips over holes in the process address space. Consequently, absolute location information is lost.

Options:

-h (default): Skip over holes in the process address space, so that absolute location information is lost.
-H: Preserve holes in the process address space, so that absolute location information is preserved. This option writes holes to the output file, and requires that stdout is redirected to file. This option does not work on some Solaris versions.
-m mapfile: Print the process memory map to mapfile, one entry per line. Each map entry consists of a region start address and the first address beyond that region. Addresses are separated by space, and are printed as hexadecimal numbers (0xhhhh).
-v: Enable verbose mode, for debugging purposes.

BUGS

On systems with a usable /proc file system, pcat does not stop the target process before accessing its memory. This can result in a loss of accuracy.

pcat uses ptrace(2) when the system lacks a usable /proc file system. This can be very, very, slow.

The use of ptrace(2) causes the target process to be stopped while its memory being is copied. This can be undesirable.

On some systems, the ptrace(2) detach operation resumes a process that was stopped prior to the ptrace(2) attach operation. pcat attempts to compensate by sending SIGSTOP signals when it detaches from the process.

On some systems, the ptrace(2) detach operation leaves a process stopped that was not stopped prior to the ptrace(2) attach operation. pcat attempts to compensate by sending a SIGCONT signal when it detaches from the process.

On most non-/proc systems, pcat accesses kernel data structures and therefore 1) needs super-user privilege and 2) must be compiled specifically for the machine that it runs on.

pcat will not copy its own memory.

pcat will not copy system processes (i.e. processes that live entirely inside the kernel).

HISTORY

This pcat command was written for the coroner's toolkit. However, a command with the same name exists on some versions of System V UNIX. That command, a file decompression utility, should not be confused with the command described in this manual page.

LICENSE

This software is distributed under the IBM Public License.

AUTHOR(S)

Wietse Venema
IBM T.J. Watson Research
P.O. Box 704
Yorktown Heights, NY 10598, USA

This document was created by man2html, using the manual pages.
Time: 01:01:08 GMT, August 19, 2000