Jun
3
Published by Kieran in Computer Science
· Leave your thoughts
( words)
( words)
I was recently a fool and accidentally deleted my nginx sites-enabled configurations. After endless mopping, I stumbled across this. If you add the below to file such as “find_nginx_config.sh”:
# Set pid of nginx master process here pid=8192 # generate gdb commands from the process's memory mappings using awk cat /proc/$pid/maps | awk '$6 !~ "^/" {split ($1,addrs,"-"); print "dump memory mem_" addrs[1] " 0x" addrs[1] " 0x" addrs[2] ;}END{print "quit"}' > gdb-commands # use gdb with the -x option to dump these memory regions to mem_* files gdb -p $pid -x gdb-commands # look for some (any) nginx.conf text grep worker_connections mem_* grep server_name mem_*
Then:
chmod +x find_nginx_config.sh ./find_nginx_config.sh
If you’re in luck it will tell you which file potentially holds the key to your woes. Sadly, in my case the memory had been overwritten in various places however after 20minutes of manually pulling bits from the binary file I managed to reconstruct the original configuration files. It should be fairly obvious where the configuration starts if you search the file for terms such as “location” or “server” and then manually scroll through.
Best of luck.