Questions tagged [dump]
The dump tag has no usage guidance.
15
questions
1
vote
0
answers
110
views
UBIFS image weirdness [SOLVED]
So, I dumped old routers ubifs image from memory and apparently it can't be read or mounted, throwing errors like "missing block size" and "missing data" although I see in hexdump ...
3
votes
0
answers
457
views
Anti Dumping Techniques (C++)
how would I go about blocking Memory Dumps by corrupting the PE Header or blocking the Debugger to get an Handle?
I tried this already but it didnt work. Scylla could still dump it fine.
3
votes
0
answers
393
views
Is it possible to dump firmware of a device via USB port?
I have a device which can be connected via USB port. The vendor of this device provides a tool for upgrading firmware of this device via USB port.
lsusb command says that this device has following ...
0
votes
1
answer
112
views
Imports shifting in the dump
Dumped the PE using Scylla, analysing without issues, but when I was trying to inspect codes, I see that IDA analysed imports incorrectly.
It means that I see for example MapViewOfFile(), which ...
1
vote
2
answers
599
views
How to get root access on Linux embedded system?
I've saved from the trash bin an embedded system using an OPOS6UL (http://www.armadeus.org/wiki/index.php?title=OPOS6UL) as Single Board Computer.
It was easy to get an UART console, but I cannot log ...
1
vote
0
answers
117
views
static core dump analysis
I got a coredump from an unknow binary. I want to retrieve as many information as possible (memory, register, contexte..)
Most of the answers available on the web speak about coredump analysis using ...
1
vote
0
answers
141
views
How to identify the NonPagedPool Start Memory address from a memory dump
I need to find the memory address where starts the NonPagedPool. I saw some people doing it with Rekall, but I'm having a lot of problems with it.
Is that possible with Volatility ?
Tks
3
votes
1
answer
237
views
Certain bytes in the memory (RAM) get changed after the program starts. Why?
I'm in a situation where I have an executable file. When I start it within the debugger (x32dbg), with breakpoints set to every occasion (DLL entry, DLL load, Thread start,..), to restrict the amount ...
4
votes
1
answer
2k
views
How to dump firmware from car head-unit (VW Radio)
I have a VW Radio which has the possibility to upgrade software via USB. Unfortunately I am not able to find any updates, nor any information regarding the current Software version on the whole ...
3
votes
2
answers
1k
views
How to dump a firmware from an old cell phone with Linux?
I have a "MiracleBox" software for GSM repairing and and old cell phone (Wiko Lubi 4) with a RD8851CL chip inside.
With this MiracleBox running on Windows I can make a dump of this chip without ...
5
votes
3
answers
229
views
Finding a malware object inside PE file
Today my AV found an antique piece of malware called Win9X.CIH.dam.
Instead of just removing it I would like to make a little research for fun.
What does "data0513" exactly mean? I can't understand ...
2
votes
1
answer
761
views
Dump firmware from MC9S08EL32 MCU
I have a datasheet of the HCS08 micro-controller family from NXP. I have a Raspberry Pi and some time. I admit that this is my first time delving this deep into hardware RE, so be gentle with me.
I ...
1
vote
1
answer
436
views
Need script to analyze process dump file (windows)
I have a program written in c++, it's compiled with Visual Studio.
I have a mini dump file of a running process (process generates it using winapi MiniDumpWriteDump function).
I also have several ...
0
votes
1
answer
340
views
Dump data from segments.io /segment.com with apikey
I am analyzing an app and in it's data I found an apikey for segments.io.
Using this apikey, is it possible to see what data is stored or perhaps even dump it?
9
votes
3
answers
11k
views
Extracting a NAND flash dump with OOB data
I'm trying to extract a NAND flash dump of an old Walkman player. The dump was done by a friend and unfortunately cannot be redone because the chip was destroyed.
The dump was supposed to be just user ...