tag: #shell

A binary deleted from disk while the process is still running is not actually gone. The kernel keeps the inode alive as long as the process holds it, and /proc/PID/exe is a real readable handle to it. You can copy a running program out of /proc and reconstruct it on disk byte for byte.

The bash !$ history expansion substitutes the last argument of the previous command which turns destructive operations like rm into a two-step ritual where the first step is always a preview.