@j3s Wait, couldn't you do the same thing by scanning the process's memory at /proc/<pid>/mem ?