Skip to main content

walk_bash_history

memf_linux::bash

Function walk_bash_history 

Source 
pub fn walk_bash_history<P: PhysicalMemoryProvider>(
    reader: &ObjectReader<P>,
) -> Result<Vec<BashHistoryInfo>>
Expand description

Walk all bash processes and recover command history from their heaps.

Finds processes with comm == "bash", then scans their anonymous RW VMAs for HIST_ENTRY patterns — 24-byte structs where the first pointer leads to a printable ASCII string and the second leads to a #DIGITS timestamp string.