Bash Dump History

Using gdb to trigger the internal bash function to write out it's history still in memory but not on disk

#!/usr/bin/env bash

# Given the PID of an active bash process, dump it's history
# using gdb and the function within bash named write_history()
# to a temp file.

# Input is the running PID of the bash process to dump
BPID=$1

gdb --batch --eval "attach ${BPID}" \
  --eval "call (int)write_history(\"/tmp/bash_history-${BPID}.txt\")" \
  --eval 'detach' --eval 'q'

echo "Wrote /tmp/bash_history-${BPID}.txt"

# example:
#  ./dump_bash_history.sh 1019
#  0x00007f80483e506b in waitpid () from /usr/lib/libc.so.6
#  $1 = 0
#  [Inferior 1 (process 1019) detached]
#  Wrote /tmp/bash_history-1019.txt

# http://git.savannah.gnu.org/cgit/bash.git/tree/lib/readline/histfile.c#n784
# /* Overwrite FILENAME with the current history.  If FILENAME is NULL,
#    then write the history list to ~/.history.  Values returned
#    are as in read_history ().*/
# int
# write_history (const char *filename)
# {
#   return (history_do_write (filename, history_length, HISTORY_OVERWRITE));
# }

Index

SPDX-License-Identifier: CC-BY-SA-4.0
SPDX-License-Identifier: MIT