1/ #Linux #Forensics: pssst... I will now reveal my favorite interview question for candidates who want to work in our IR team ;) "In the process list, I see a (running) binary, but the binary is no longer present on disc. How can I restore the original binary? (screenshot 👇)" 
2/ Many candidates (and other analysts) I have spoken to did not know the (simple?) answer.
Under /proc/[pid]/exe, a 1:1 copy of the executed binary is stored! As you can see in the screenshot, the hash sums of both binaries match precisely.
Under /proc/[pid]/exe, a 1:1 copy of the executed binary is stored! As you can see in the screenshot, the hash sums of both binaries match precisely.
3/ According to the proc(5) manpage:
"You can even type /proc/[pid]/exe to run another copy of the same executable that is being run by process [pid]."
"You can even type /proc/[pid]/exe to run another copy of the same executable that is being run by process [pid]."
4/ Under /proc/[pid]/, there is other interesting information, e.g., the directory "fd":
"This is a subdirectory containing one entry for each file that the process has open, named by its file descriptor, and which is a symbolic link to the actual file."
"This is a subdirectory containing one entry for each file that the process has open, named by its file descriptor, and which is a symbolic link to the actual file."
• • •
Missing some Tweet in this thread? You can try to
force a refresh
