Is there any command in OllyScript that can fetch me table shown in Memory Map window of OllyDbg. (Memory window comes up when you click on "M" icon.) It shows address, size, Owner, Section, Contains, Type, Access, Initial, and Mapped as. But I only need Address, Size, Owner, contains. So even if I can somehow get these details it would be fine.
1 Answer
if you are comfortable with text parsing
right_click-> copy to clipboard->wholetable
paste to foo.txt and print the required columns with awk
awk "{print $1,$2,$3,$5}" memor.txt | head -n 6
Memory map
Address Size Owner Contains
00010000 00010000 > Heap
00030000 00004000 > Map
00040000 00002000 > Map
00050000 00001000 > Priv
update
use windbg !address command with -c "cmdstr" option as pasted below
%1 to %7
are place holders respectively for
base,end,size .type , state,protection and usage
that !address command understand and replaces in the command string
0:000> !address -c:".printf \"%8x\\t%8x\\t%7\\t %4\\n\" , %1 , %3"
0 10000 Free
10000 10000 Heap MEM_MAPPED
20000 10000 Free
30000 4000 Other MEM_MAPPED
34000 c000 Free
40000 2000 Other MEM_MAPPED
42000 e000 Free
50000 1000 Other MEM_PRIVATE
51000 5f000 Free
b0000 3c000 Stack MEM_PRIVATE
ec000 1000 Stack MEM_PRIVATE
ed000 3000 Stack MEM_PRIVATE
f0000 67000 MappedFile MEM_MAPPED
157000 19000 Free
170000 6000 Heap MEM_PRIVATE
176000 fa000 Heap MEM_PRIVATE
270000 920000 Free
b90000 1000 Image MEM_IMAGE
b91000 53000 Image MEM_IMAGE
be4000 5000 Image MEM_IMAGE
be9000 67000 Image MEM_IMAGE
c50000 6ccc0000 Free
6d910000 1000 Image MEM_IMAGE
-
I have to repeat the procedure many times. So I am looking for a method/tool/automation/anything that can do this automatically. After that I need to take dumps of some sections. It need not necessarily be Ollydbg. Anything which gives me this mapping and can take required dumps.– ShanNov 29, 2016 at 9:11
-
-
Hi, This is quite helpful. Thanks. Now I will find the command to take the dump of sections, and pass the addresses to them. :)– ShanDec 2, 2016 at 7:32
-
If it answered your query maybe you can mark it as such and or upvote so that others who look can find it easily– blabbDec 2, 2016 at 11:37
-
Yes, I did that already. But I am do not have the required reputation points for my upvote to be publicly displayed. :/– ShanDec 2, 2016 at 11:46