Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Compare a running process in memory with an executable in disk

I have a big project which will load an executable (let's call it greeting) into memory, but for some reason (e.g. there are many files called greeting under different directories), I need to know if the process in memory is exactly the one I want to use.

I know how to compare two files: diff, cmp, cksum and so on. But is there any way to compare a process in memory with an executable in hard disk?

like image 999
MasterMind Avatar asked Dec 19 '16 01:12

MasterMind


1 Answers

According this answer you can get the contents of the memory version of the binary from the proc file system. I think you can cksum the original and the in memory version.

According to the man page of /proc, under Linux 2.2 and later, the file is a symbolic link containing the actual pathname of the executed command. Apparently, the binary is loaded into memory, and /proc/[pid]/exe points to the content of the binary in memory.

like image 193
ojblass Avatar answered Dec 04 '22 19:12

ojblass