1.ida运行脚本
autoi,fp,begin,end;
fp=fopen("D:\\xx.so","wb");
begin=0xAC338000;
end=0xAC393000;
for(i=begin;i<end;i++)
{
fputs(Byte(i),fp);
}
2.gdb dump
dump binary memoryC:\Users\DW\Desktop\baidu_jiagu\so\baidu 0xa8878000 0xA8B9C000
3.dd命令
dd if=/proc/1214/mem of=mmm skip=a8878000 ibs=1 count=324000 这个不行,网上误传