#!/usr/bin/env python3 import os, glob, sys, re, time def find_procs(): out = [] for p in glob.glob('/proc/[0-9]*'): try: cmd = open(p + '/cmdline','rb').read().replace(b'\0',b' ').decode('utf8','replace') st = open(p + '/stat','rb').read().decode('utf8','replace') state = st.split(')')[-1].split()[0] except Exception: continue if 'yabridge' in cmd or 'wine' in cmd: out.append((int(os.path.basename(p)), state, cmd.strip())) return out def dump_module(pid): maps = open(f'/proc/{pid}/maps').read() regs = [] for line in maps.splitlines(): parts = line.split() if len(parts) < 6: continue addr, perms, off, dev, ino, *rest = parts if 'soothe2' in ' '.join(rest) and 'r' in perms: lo, hi = (int(x,16) for x in addr.split('-')) regs.append((lo, hi, perms, ' '.join(rest))) if not regs: print(f' pid {pid}: no soothe2 maps') return print(f' pid {pid}: {len(regs)} sobering readable regions') total = 0 mem = os.open(f'/proc/{pid}/mem', os.O_RDONLY) try: for lo, hi, perms, path in regs: size = hi - lo try: data = os.pread(mem, size, lo) except Exception as e: print(f' region {lo:#x}-{hi:#x} ({perms}) READ FAIL: {e} [{path}]') continue fn = f'/home/m/re-tools/regions/pid{pid}_{lo:08x}_{hi:08x}_{perms.replace("-","")}.bin' with open(fn,'wb') as f: f.write(data) total += len(data) print(f' dumped {lo:#x}-{hi:#x} size={len(data):#x} rw={perms} -> {fn.split("/")[-1]}') finally: os.close(mem) print(f' total {total} bytes') for pid, state, cmd in find_procs(): print(f'{pid} [{state}] {cmd}') if state == 'S': dump_module(pid)