5

I have a process running very long time.

I accidentally deleted the binary executable file of the process.

Since the process is still running and doesn't get affected, there must be the original binary file in somewhere else....

How can I get recover it? (I use CentOS 7, the running process is written in C++)

Improve this question
7

It could only be in memory and not recoverable, in which case you'd have to try to recover it from the filesystem using one of those filesystem recovery tools (or from memory, maybe). However!

$ cat hamlet.c
#include <unistd.h>
int main(void) { while (1) { sleep(9999); } }
$ gcc -o hamlet hamlet.c
$ md5sum hamlet
30558ea86c0eb864e25f5411f2480129  hamlet
$ ./hamlet &
[1] 2137
$ rm hamlet
$ cat /proc/2137/exe > newhamlet
$ md5sum newhamlet 
30558ea86c0eb864e25f5411f2480129  newhamlet
$

With interpreted programs, obtaining the script file may be somewhere between tricky and impossible, as /proc/$$/exe will point to perl or whatever, and the input file may already have been closed:

$ echo sleep 9999 > x
$ perl x &
[1] 16439
$ rm x
$ readlink /proc/16439/exe
/usr/bin/perl
$ ls /proc/16439/fd
0  1  2

Only the standard file descriptors are open, so x is already gone (though may for some time still exist on the filesystem, and who knows what the interpreter has in memory).

Improve this answer
4
  • 4
    The reason it works is actually FS related since the file still has allocated blocks because it's still open. That said, I adore your solution which is by far the simplest. – Julie Pelletier Feb 4 '17 at 2:58
  • To @julie-pelletier: Yes, but file removing requires to delete all hard links to it and to close it in all programs (free descriptor by close() system call). Thus, you can remove file (use unlink() in rm), but you have guaranties that file will be available until program end (f.e. try to overwrite it with shred command and you won't be able to do it). – ValeriyKr Feb 4 '17 at 3:19
  • @ValeriyKr: Exactly! – Julie Pelletier Feb 4 '17 at 4:40
  • Sorry, i understood you really wrong when decided to answer. It was deep night here. I guess, there is no reason to delete detailed explanation of how it works. – ValeriyKr Feb 5 '17 at 5:41
3

You said its C++ so it should be possible to dump it from memory.

First you want to find the process in memory:

$ cat /proc/[pid]/maps
00400000-00404000 r-xp 00000000 ca:01 16823     /home/ec2-user/a.out (deleted)

Then you can dump it

$ gdb --pid [pid]
dump memory /home/ec2-user/output 0x00400000 0x00404000

Then you should be able to run it by marking it as executable (chmod +x)

$ file output
output: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, missing section headers
Improve this answer
1
  • You don't need gdb for the dump - you can "$ sudo cat /proc/[pid]/map_files/00400000-00404000 > output" – joonas.fi Aug 2 '20 at 11:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.