Questions tagged [dump]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
9 votes
3 answers
11k views

Extracting a NAND flash dump with OOB data

I'm trying to extract a NAND flash dump of an old Walkman player. The dump was done by a friend and unfortunately cannot be redone because the chip was destroyed. The dump was supposed to be just user ...
Igor Skochinsky's user avatar
  • 36.6k
5 votes
3 answers
229 views

Finding a malware object inside PE file

Today my AV found an antique piece of malware called Win9X.CIH.dam. Instead of just removing it I would like to make a little research for fun. What does "data0513" exactly mean? I can't understand ...
Ian Smuga's user avatar
4 votes
1 answer
2k views

How to dump firmware from car head-unit (VW Radio)

I have a VW Radio which has the possibility to upgrade software via USB. Unfortunately I am not able to find any updates, nor any information regarding the current Software version on the whole ...
Andrei Bucur's user avatar
3 votes
2 answers
1k views

How to dump a firmware from an old cell phone with Linux?

I have a "MiracleBox" software for GSM repairing and and old cell phone (Wiko Lubi 4) with a RD8851CL chip inside. With this MiracleBox running on Windows I can make a dump of this chip without ...
masterphone24's user avatar
3 votes
1 answer
238 views

Certain bytes in the memory (RAM) get changed after the program starts. Why?

I'm in a situation where I have an executable file. When I start it within the debugger (x32dbg), with breakpoints set to every occasion (DLL entry, DLL load, Thread start,..), to restrict the amount ...
Patrik Staron's user avatar
3 votes
0 answers
468 views

Anti Dumping Techniques (C++)

how would I go about blocking Memory Dumps by corrupting the PE Header or blocking the Debugger to get an Handle? I tried this already but it didnt work. Scylla could still dump it fine.
Heinz Josef's user avatar
3 votes
0 answers
400 views

Is it possible to dump firmware of a device via USB port?

I have a device which can be connected via USB port. The vendor of this device provides a tool for upgrading firmware of this device via USB port. lsusb command says that this device has following ...
Simon Rusinov's user avatar
2 votes
1 answer
775 views

Dump firmware from MC9S08EL32 MCU

I have a datasheet of the HCS08 micro-controller family from NXP. I have a Raspberry Pi and some time. I admit that this is my first time delving this deep into hardware RE, so be gentle with me. I ...
Devon's user avatar
  • 21
1 vote
2 answers
618 views

How to get root access on Linux embedded system?

I've saved from the trash bin an embedded system using an OPOS6UL (http://www.armadeus.org/wiki/index.php?title=OPOS6UL) as Single Board Computer. It was easy to get an UART console, but I cannot log ...
fdamien12's user avatar
1 vote
1 answer
438 views

Need script to analyze process dump file (windows)

I have a program written in c++, it's compiled with Visual Studio. I have a mini dump file of a running process (process generates it using winapi MiniDumpWriteDump function). I also have several ...
lesnik's user avatar
  • 111
1 vote
0 answers
112 views

UBIFS image weirdness [SOLVED]

So, I dumped old routers ubifs image from memory and apparently it can't be read or mounted, throwing errors like "missing block size" and "missing data" although I see in hexdump ...
Josip Stjepanović's user avatar
1 vote
0 answers
119 views

static core dump analysis

I got a coredump from an unknow binary. I want to retrieve as many information as possible (memory, register, contexte..) Most of the answers available on the web speak about coredump analysis using ...
MrHeliose's user avatar
1 vote
0 answers
141 views

How to identify the NonPagedPool Start Memory address from a memory dump

I need to find the memory address where starts the NonPagedPool. I saw some people doing it with Rekall, but I'm having a lot of problems with it. Is that possible with Volatility ? Tks
Alexandre Vieira's user avatar
0 votes
1 answer
112 views

Imports shifting in the dump

Dumped the PE using Scylla, analysing without issues, but when I was trying to inspect codes, I see that IDA analysed imports incorrectly. It means that I see for example MapViewOfFile(), which ...
John's user avatar
  • 1
0 votes
1 answer
353 views

Dump data from segments.io /segment.com with apikey

I am analyzing an app and in it's data I found an apikey for segments.io. Using this apikey, is it possible to see what data is stored or perhaps even dump it?
Remko's user avatar
  • 3,228