20.2.4 Dumping memory

There are different commands to dump these sections to disk. The '!dump' and '!restore' are used to create a directory called 'dump#' where '#' is a number starting from 0 and is incremented while called multiple times. So you can use '!dump' and '!restore' to go 'forward' and 'backward' of the process status. Because it is also dumping and restoring the register values.

[0x4A13B8C0]> !dump
Dump directory: dump0
Dumping BFE15000-BFE2A000.dump  ; 0x00015000  [stack]
Dumping 4A155000-4A157000.dump  ; 0x00002000  /lib/ld-2.5.so
Dumping 0805C000-0805D000.dump  ; 0x00001000  /bin/ls
Dumping 08048000-0805C000.dump  ; 0x00014000  /bin/ls
Dumping CPU to cpustate.dump...

You can also specify the directory name as argument:

[0x4A13B8C0]> !dump foo
...
[0x4A13B8C0]> !restore foo

The '!dall' command is similar to the previous one, but it is based on the concept that there are no maps sections information. This is useful on some unixes like some BSDs that they have no /proc to get this information. So it reads from 0 to 0xFFFFFFFF looking for readables pages and dumping them to files named 'from-to.bin' in the current directory.