Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [dumping]

Process of copying the content of a block of a program's memory to file. It can be not trivial if the target program hooked memory-related APIs.

1
vote
2answers
149 views

Manually unpacking upx

As a first unpacking exercise, I decided to try to unpack the famous UPX (without using upx -d of course). I chose an executable I had somewhere, built from C++ code in debug mode. I packed it using ...
2
votes
2answers
182 views

How to dump a firmware from an old cell phone with Linux?

I have a "MiracleBox" software for GSM repairing and and old cell phone (Wiko Lubi 4) with a RD8851CL chip inside. With this MiracleBox running on Windows I can make a dump of this chip without ...
1
vote
1answer
53 views

Fixing up data sections of a malware sample in IDA database?

I have a piece of malware dumped by segments. A lot of the data section seems to be screwed up when loaded into IDA Pro. First of all, pointers are stored in a single array which is incorrect. I want ...
0
votes
0answers
447 views

Trying to dump an assembly .NET

I have an application made in mono. Someone is injecting a dll to make "bad things". I've been able to detect it because it adds an event to AppDomain and with some reflection I detect the assembly. ...
1
vote
2answers
179 views

Dumping Memory to Raw File

Is there a way to dump a section of process memory knowing the start and end address to raw bin file via a winapi function or some other method? I know that you can do this easily with a debugger, but ...
1
vote
1answer
64 views

Dump Sequence Data from Casio electronic keyboard

I’m not quite sure whether this is the right website to post this on but... I want to try and dump sequence data from a Casio Keyboard default soundbank I believe it’s stored on a ROM chip of some ...
1
vote
1answer
302 views

Router flash dump unknown filesystem

I'm trying to reverse engineering my router firmware after reading an interesting article about an hidden backdoor inside router firmwares from a popular company. Data has been extracted (using ...
8
votes
1answer
254 views

How can I determine if NAND blocks are good blocks?

I'm trying to rescue some data from our hardware. On the board I have a pair of Samsung k9f4g08u0d NAND chips. Each chip has been dumped to include every block, including the spare areas. If I invert ...
0
votes
1answer
921 views

Fixing dump files in ida

ive recently dumped a few mem page sections of a possibly malicious dll. However, I can't analyze the files correctly since i don't know how to allign all the sections correctly for analysis at once ...
5
votes
2answers
1k views

Why to dump precisely at OEP while manual unpacking?

What is the exact reason for dumping a process when the Program Counter is at OEP? I haven't found a decent answer. This Link says: In order to identify the IAT structure, Import Reconstructor ...
-3
votes
1answer
829 views

Dumping ipa file on iOS 10.2 [closed]

Is there a way to dump .ipa file on iOS 10.2 (jailbroken) for future reverse-engineering? Tried to use Clutch, it doesn't dump the app. Just exits with 2017-03-13 23:17:24.702 Clutch[2195:100953] ...
0
votes
1answer
1k views

Dumping Flash Memory Using Bus Pirate

I'm planning on dumping and reading the flash memory of a Winbond W25Q128FV chip. I've done some research and plan on buying the following tools to achieve this: Bus Pirate 3.6a Probe Cable SOIC8 ...
1
vote
1answer
895 views

Help mounting jffs2 dumped from NAND flash.

Ok so have been trying to look some settings from a jffs2 partition I extracted from a nand dump I had done previously Here ----> https://forum.openwrt.org/viewtopic.php?id=67564 Steps I have ...
0
votes
1answer
1k views

Unpacking and dumping executable from DLL

I'm trying to unpack and dump executable from a DLL packed file, I've loaded the DLL to Immunity Debugger using LOADDLL.exe. I think I've reached the OEP 0x3DADDD (the memory location of the unpacked ...
2
votes
1answer
782 views

Dump a child process created by malware with an ALTERNATIVE process hollowing process

I'm reversing a malware which uses a variant of Process Hollowing to create a process which I can't dump. I don't know what I'm doing wrong. I always see the suggestion to stop at GetContextThread , ...
3
votes
1answer
2k views

Process Dumping and Ida

Up until now I've been performing static analysis using Ida and run time analysis using OllyDBG. I've identified a function in Olly which I would like to start documenting further in Ida, however I ...
2
votes
0answers
758 views

Dump router firmware over U-BOOT

I connected ttl cable to my router board, and Im trying to dump firmware in order to flash second device over web interface with my backup so I have few questions: What binary file for ex. upgrade....
2
votes
1answer
378 views

Are HBGary FastDump Pro dumps compatible with WinDbg?

I have read that HBGary's FastDump Pro (FDPro) can capture kernel dumps and include the page file contents. Although I'm not sure if the tool is still available commercially (it's not listed on the ...
2
votes
2answers
208 views

I need advice on how to JTag a Microsoft Band

I am studying Computer Forensics in at a university in the UK and for my final year project, I wanted to combine my love of Microsoft products and Computer Forensics to see what kind of information a ...
1
vote
0answers
1k views

Dump a MX25L12845E with a bus pirate and flashrom

I just received my buspirate, I now want to dump a flash (MX25L12845E). I tried the following command: flashrom -V -p buspirate_spi:dev=/dev/tty.usbserial-AJ02XILF,spispeed=1M -r MX25L128.bin -c ...
17
votes
2answers
3k views

In which language is the BIOS written?

As I understand, the BIOS code/bitstream that held in the ROM should be generic (work alongside with multiple CPU types or ISAs). In addition, I saw mentions in the web that claim to have the ...
4
votes
0answers
148 views

Trying to obtain embedded flash memory on MCP5554 microcontroller

I am capable of dumping flash memory directly from EEPROM; however I am trying to pull data from a microcontroller that has an embedded 2 Mbyte flash in it. I understand that JTAG is one way to go. ...
3
votes
1answer
1k views

Unable to dump a process

I'm trying to reverse a malware sample with the following MD5: ef668a0cd0755c67930ece13d28a6bda. Obvious, this is a packed malware. On a first look, it seems to bee some GUI Programm, but at some ...
3
votes
2answers
2k views

Fixing import table of unpacked DLL with ImpREC : ImpRec throws “invalid OEP!” error

I am trying to unpack a DLL and fix the import tables with ImpRec. However, I am stuck with this error. Following is what I have tried. Modified the flag in its PE header so that windows loads the ...
2
votes
4answers
6k views

Unpacking and dumping using ollydump

I am trying to learn how to unpack a malware. I am trying this with ollydbg. However, when I try to dump the unpacked using ollydump plugin. It prompts the error "Bad DOS signature!!". Could someone ...
0
votes
2answers
767 views

Automatically list of mapped memory locations(and their attributes) of a running process

I am trying to obtain the memory map of a process. One way I can think of doing this is to attach Olly/Immunity Debugger to the process and copy the memory map to the clipboard. However, this is ...
1
vote
1answer
237 views

Getting MSRs from Windows Crash Dump

I'm analyzing a crash dump BSOD on a windows box where I suspect some malware is doing something with the MSRs but it doesn't look like any of them are available via the wrmsr and rdmsr commands. Is ...
2
votes
3answers
584 views

Dumping a file loaded into memory

We have an executable that loads an XML file into memory, before parsing it into objects. When this file is loaded into memory is it possible to, break when it is loaded into memory and then somehow ...
3
votes
1answer
597 views

An issue when unpacking UPX

Since I love to play with the WinAPI or debugging in general, I decided to write a small unpacker for the open source PE executable packer UPX today (Windows version). In order to accomplish this, I ...
1
vote
0answers
318 views

beginner hardware sniffing question

this is not going to be a specific question but here goes. Ive just started reading about reverse engineering for the 3ds. Is it possible to open the 3ds up and connect a probe somewhere on the chip ...
4
votes
3answers
6k views

Dumping firmware through mtdblock device

This is my first attempt at doing some reverse engineering. I'm trying to dump the filesystem off a huawei hg523a TalkTalk router. The problem is its quite limited in the amount of programs that are ...
4
votes
2answers
2k views

How does Ollydbg obtain the memory map (alt+m)? [closed]

I've been looking for any Windows functions to view or dump memory, or the process to do this manually. I can not find info on this anywhere online. How would I get a dump of a process's memory like ...
6
votes
1answer
169 views

Where are program resources stored in a CIL assembly?

In a CIL assembly, where are resources stored? I am trying to reverse engineer a sample that appears to be protected by a .NET crypter. The CIL assembly for the sample does a SHA256 decryption on a ...
4
votes
2answers
800 views

windbg crashdump process by pid from kernel

What is the best way to dump user space process by pid debugging the kernel with windbg? I'm able to attach to the process from user-space with windbg and generate crash by .dump, but how would I do ...
6
votes
3answers
3k views

Can't access process memory when dumping

I'm trying to analyse a piece of malware and after finding the OEP I'm having trouble dumping the process. Using LordPE (and IDA) I get an error saying "Couldn't grab process memory", I searched for ...
10
votes
1answer
6k views

Get code from protected PIC

I have a PIC18F4550 from an old device and I need to see the code. I tried reading it using my ICD3 programmer, but the chip seems to have its code protected. How can I get the code anyway?
31
votes
3answers
19k views

How do I figure out what is burned on an Arduino ROM?

I have an Arduino Uno Rev3. I would like to extract and find out what code is burned on the ROM of the micro-controller board. How do I extract the code from the board? How do I figure out the ...