How to interpret memory dumps?

Question

I'm pretty new to reverse engineering, and I decided to pick up https://microcorruption.com/ CTF to understand a bit more. The following code is from the tutorial section.

In a disassembled file, we have this code (I've selected just a snippet):

0010 <__trap_interrupt>

0010:  3041           ret

4400 <__init_stack>

4400:  3140 0044      mov   #0x4400, sp

4404 <__low_level_init>

4404:  1542 5c01      mov   &0x015c, r5

4408:  75f3           and.b #-0x1, r5

440a:  35d0 085a      bis   #0x5a08, r5

Using a kind of debugger, the live memory dump looks like:

0000:   0000 4400 0000 0000 0000 0000 0000 0000   ..D.............

0010:   *

4400:   3140 0044 1542 5c01 75f3 35d0 085a 3f40   [email protected]\.u.5..Z?@

4410:   0000 0f93 0724 8245 5c01 2f83 9f4f 8645   .....$.E\./..O.E

4420:   0024 f923 3f40 0000 0f93 0624 8245 5c01   .$.#?@.....$.E\.

4430:   1f83 cf43 0024 fa23 3150 9cff 3f40 a844   ...C.$.#[email protected]

4440:   b012 5845 0f41 b012 7a44 0f41 b012 8444   ..XE.A..zD.A...D

4450:   0f93 0520 3f40 c744 b012 5845 063c 3f40   ... [email protected].<?@

4460:   e444 b012 5845 b012 9c44 0f43 3150 6400   .D..XE...D.C1Pd.

4470:   32d0 f000 fd3f 3040 8445 3e40 6400 b012   [email protected]>@d...

4480:   4845 3041 6e4f 1f53 1c53 0e93 fb23 3c90   HE0AnO.S.S...#<.

4490:   0900 0224 0f43 3041 1f43 3041 3012 7f00   ...$.C0A.C0A0..

44a0:   b012 f444 2153 3041 456e 7465 7220 7468   ...D!S0AEnter th

So, what I could understand is that we have the memory address in the first column and the content in both hex and ASCII encodings on the second and third columns respectively. But what I cannot understand is: what does these information, both in hex and ASCII, mean? What exactly is the concept of memory dump in a disassembled file?

These bytes seem to create random ASCII strings, but in other parts of the code, they create meaningful strings just like the following:

44a0:   b012 f444 2153 3041 456e 7465 7220 7468   ...D!S0AEnter th

44b0:   6520 7061 7373 776f 7264 2074 6f20 636f   e password to co

44c0:   6e74 696e 7565 0049 6e76 616c 6964 2070   ntinue.Invalid p

I know that this question may sound very wide, so links to documentation where I could find this information and learn more would be appreciated.

Answer 1

As far as I know the dump shows just the raw binary of the file/memory when executed, so most of the content is the machine code in hex format, and it's ASCII decoded representation doesn't have any meaning.

You may notice that the opcodes at "line" 4400 are present at the same offset in the hexdump.

The strings used, for example, in prints are saved in plaintext in the file (ASCII encoded), so you can read them directly from there.

Note: if you are just searching for sequences of printable chars, you can use the strings command.