Questions tagged [dumping]

Process of copying the content of a block of a program's memory to file. It can be not trivial if the target program hooked memory-related APIs.

Filter by
Sorted by
Tagged with
1 vote
1 answer
219 views

Retrieve & dump type information from IDA Pro

I want to retrieve IDA Pro .idb database's each type info, such as: size and name of a structure; each member variable type and name; each member variable size and offset; And dump it to a .h file ...
void_17's user avatar
  • 33
3 votes
0 answers
456 views

Anti Dumping Techniques (C++)

how would I go about blocking Memory Dumps by corrupting the PE Header or blocking the Debugger to get an Handle? I tried this already but it didnt work. Scylla could still dump it fine.
Heinz Josef's user avatar
0 votes
0 answers
479 views

extracting data from dump files

I have used Frida and Fridump for Memory Dump & Strings Dump on a mobile device so ,now I have about 500 Files with dump.data format. first, I want to extract any pdf files and save them in my pc ...
Hadimsv's user avatar
  • 101
1 vote
0 answers
59 views

I attempted to read from an Intel 87C54 microcontroller and it came up all FF's. Any way to read from this?

I'm using the popular TL866II Plus programmer to read from the chip. I see in the datasheet that it has lock bits which can disable the verify (read) function, but I'm not sure if that causes an ...
Sparkette's user avatar
  • 166
0 votes
0 answers
415 views

Reconstructing "relative" import functions in IDA

Apologies in advance if any premises of my question are incorrect, I'm rebuilding imports for the first time and I'm frankly pretty overwhelmed. I'm reverse engineering a packed win32 executable, so I ...
Steven Kyle's user avatar
3 votes
1 answer
2k views

Rebuild IAT after manually unpacking DLL

I've been trying to unpack this dll and I'm pretty sure that 0x7c3ea902 or 0x1007A9D2 (ASLR disabled) or simply 0x7A9D2 is OEP. But after dumping with OllyDumpEx and trying to fix IAT with ImpREC it ...
majidarif's user avatar
  • 235
2 votes
0 answers
491 views

How can i extract u-boot image from fgt90d.out firmware and install Openwrt image?

I have a lot of out of licensed Fortigate90D devices so i want to reuse and run Openwrt/pfsense on them. I have dumped and decoded the bios and got some useful datas, according to datas we can see u-...
alfa's user avatar
  • 21
3 votes
1 answer
580 views

Decoding algorithm with checksum

I'm a newbie, so I'm asking for your help. I have to decode dumped data from an appliance because I wanted to try understand the data. The data are in this format and some information are known: 7E 00 ...
Daniel Davis's user avatar
1 vote
1 answer
215 views

How to keep symbols when taking memory snapshot with IDA?

When i take memory snapshot with IDA to try to analyze it statically later, the problem is there are a lot of symbols that get lost when i dump the memory, how can i solve this? for example this is ...
Notoriouss's user avatar
0 votes
1 answer
57 views

WinHex : There's a data that does not belong to any module

I read my process memory with WinHex in order to remove some sensitive text which may running my app into crack/hack.(license data). Now , when i open the process Entire memory with in WinHex , i can ...
Shayan Firoozi's user avatar
3 votes
1 answer
1k views

Custom nanddump and nandwrite tools

I am trying to reverse engineer a router's firmware. The device has a NAND chip, and has a cripled version of BusyBox v1.14.1. nanddump command exists but with intresting parameters, as I wasn't able ...
ekardon's user avatar
  • 31
0 votes
1 answer
264 views

Manufacturer interface on OCZ Agility 4 SSD

Inside the housing of an OCZ Agility 4 SSD I found several additional connectors on the opposite site of the SATA connectors. What are they good for and how to connect them properly? Zoomed:
Jonas Stein's user avatar
0 votes
1 answer
187 views

Can a program's memory be dumped and then reinserted?

Is it possible to dump a running program's memory (Windows OS), and then later "reinsert" that memory when the program is run again?
Coldblackice's user avatar
2 votes
1 answer
937 views

How to examine/edit stack memory contents using radare2 in debug mode?

How can i examine/edit stack contents using radare2, just like gdb ? Is there a way to examine memory using $rbp or $rsp register like below. x $rbp-10 <--- something like this which can dump from ...
sourav punoriyar's user avatar
1 vote
0 answers
110 views

Finding the function of test points on a router

I have a BCM3383 based cable router here where I ultimately want to dump the firmware. I have serial access to the broadcom bootloader and the linux console. Login for linux is unkown and telnet does ...
firsttry's user avatar
1 vote
0 answers
2k views

Dump packed dll

I am trying to analyze lua functions of game but dll is packed and I can't see them. I tried to dump dll with scylla https://github.com/NtQuery/Scylla but I still didn't get lua functions. Can someone ...
Pavle's user avatar
  • 11
3 votes
1 answer
378 views

How to wrap dump process and execute it in another PC

I debug exe file in Ida , and put breakpoint in some address. I want to create a dump of this process that I can continue running it in another Pc (without Ida) from the point I pause it with ...
g319909.nwytg.coM's user avatar
4 votes
2 answers
4k views

Manually unpacking upx

As a first unpacking exercise, I decided to try to unpack the famous UPX (without using upx -d of course). I chose an executable I had somewhere, built from C++ code in debug mode. I packed it using ...
Stud's user avatar
  • 197
3 votes
2 answers
1k views

How to dump a firmware from an old cell phone with Linux?

I have a "MiracleBox" software for GSM repairing and and old cell phone (Wiko Lubi 4) with a RD8851CL chip inside. With this MiracleBox running on Windows I can make a dump of this chip without ...
masterphone24's user avatar
2 votes
1 answer
161 views

Fixing up data sections of a malware sample in IDA database?

I have a piece of malware dumped by segments. A lot of the data section seems to be screwed up when loaded into IDA Pro. First of all, pointers are stored in a single array which is incorrect. I want ...
Bruce Hansworth's user avatar
1 vote
2 answers
1k views

Dumping Memory to Raw File

Is there a way to dump a section of process memory knowing the start and end address to raw bin file via a winapi function or some other method? I know that you can do this easily with a debugger, but ...
John Wayne's user avatar
1 vote
1 answer
163 views

Dump Sequence Data from Casio electronic keyboard

I’m not quite sure whether this is the right website to post this on but... I want to try and dump sequence data from a Casio Keyboard default soundbank I believe it’s stored on a ROM chip of some ...
Joshua Stokes's user avatar
1 vote
1 answer
1k views

Router flash dump unknown filesystem

I'm trying to reverse engineering my router firmware after reading an interesting article about an hidden backdoor inside router firmwares from a popular company. Data has been extracted (using ...
L. Darens's user avatar
7 votes
1 answer
489 views

How can I determine if NAND blocks are good blocks?

I'm trying to rescue some data from our hardware. On the board I have a pair of Samsung k9f4g08u0d NAND chips. Each chip has been dumped to include every block, including the spare areas. If I invert ...
PaulS's user avatar
  • 91
0 votes
1 answer
2k views

Fixing dump files in ida

ive recently dumped a few mem page sections of a possibly malicious dll. However, I can't analyze the files correctly since i don't know how to allign all the sections correctly for analysis at once ...
Bob Bobby's user avatar
5 votes
2 answers
3k views

Why to dump precisely at OEP while manual unpacking?

What is the exact reason for dumping a process when the Program Counter is at OEP? I haven't found a decent answer. This Link says: In order to identify the IAT structure, Import Reconstructor ...
greenpiece's user avatar
-3 votes
1 answer
2k views

Dumping ipa file on iOS 10.2 [closed]

Is there a way to dump .ipa file on iOS 10.2 (jailbroken) for future reverse-engineering? Tried to use Clutch, it doesn't dump the app. Just exits with 2017-03-13 23:17:24.702 Clutch[2195:100953] ...
cre8eve's user avatar
  • 11
0 votes
1 answer
3k views

Dumping Flash Memory Using Bus Pirate

I'm planning on dumping and reading the flash memory of a Winbond W25Q128FV chip. I've done some research and plan on buying the following tools to achieve this: Bus Pirate 3.6a Probe Cable SOIC8 ...
Dylan Leggio's user avatar
3 votes
1 answer
4k views

Help mounting jffs2 dumped from NAND flash.

Ok so have been trying to look some settings from a jffs2 partition I extracted from a nand dump I had done previously Here ----> https://forum.openwrt.org/viewtopic.php?id=67564 Steps I have ...
Path-E-Tech Management's user avatar
0 votes
1 answer
3k views

Unpacking and dumping executable from DLL

I'm trying to unpack and dump executable from a DLL packed file, I've loaded the DLL to Immunity Debugger using LOADDLL.exe. I think I've reached the OEP 0x3DADDD (the memory location of the unpacked ...
Kikapi's user avatar
  • 13
3 votes
1 answer
1k views

Dump a child process created by malware with an ALTERNATIVE process hollowing process

I'm reversing a malware which uses a variant of Process Hollowing to create a process which I can't dump. I don't know what I'm doing wrong. I always see the suggestion to stop at GetContextThread , ...
Peterlagunas's user avatar
2 votes
1 answer
5k views

Process Dumping and Ida

Up until now I've been performing static analysis using Ida and run time analysis using OllyDBG. I've identified a function in Olly which I would like to start documenting further in Ida, however I ...
user avatar
3 votes
0 answers
2k views

Dump router firmware over U-BOOT

I connected ttl cable to my router board, and Im trying to dump firmware in order to flash second device over web interface with my backup so I have few questions: What binary file for ex. upgrade....
Vido's user avatar
  • 515
2 votes
1 answer
626 views

Are HBGary FastDump Pro dumps compatible with WinDbg?

I have read that HBGary's FastDump Pro (FDPro) can capture kernel dumps and include the page file contents. Although I'm not sure if the tool is still available commercially (it's not listed on the ...
Thomas Weller's user avatar
2 votes
2 answers
272 views

I need advice on how to JTag a Microsoft Band

I am studying Computer Forensics in at a university in the UK and for my final year project, I wanted to combine my love of Microsoft products and Computer Forensics to see what kind of information a ...
A Button's user avatar
1 vote
0 answers
2k views

Dump a MX25L12845E with a bus pirate and flashrom

I just received my buspirate, I now want to dump a flash (MX25L12845E). I tried the following command: flashrom -V -p buspirate_spi:dev=/dev/tty.usbserial-AJ02XILF,spispeed=1M -r MX25L128.bin -c ...
VivienG's user avatar
  • 161
18 votes
2 answers
5k views

In which language is the BIOS written?

As I understand, the BIOS code/bitstream that held in the ROM should be generic (work alongside with multiple CPU types or ISAs). In addition, I saw mentions in the web that claim to have the ...
Reflection's user avatar
4 votes
0 answers
207 views

Trying to obtain embedded flash memory on MCP5554 microcontroller

I am capable of dumping flash memory directly from EEPROM; however I am trying to pull data from a microcontroller that has an embedded 2 Mbyte flash in it. I understand that JTAG is one way to go. ...
ChipsAhoy's user avatar
3 votes
1 answer
2k views

Unable to dump a process

I'm trying to reverse a malware sample with the following MD5: ef668a0cd0755c67930ece13d28a6bda. Obvious, this is a packed malware. On a first look, it seems to bee some GUI Programm, but at some ...
0xDEADC0DE's user avatar
3 votes
2 answers
5k views

Fixing import table of unpacked DLL with ImpREC : ImpRec throws "invalid OEP!" error

I am trying to unpack a DLL and fix the import tables with ImpRec. However, I am stuck with this error. Following is what I have tried. Modified the flag in its PE header so that windows loads the ...
aMa's user avatar
  • 303
3 votes
4 answers
13k views

Unpacking and dumping using ollydump

I am trying to learn how to unpack a malware. I am trying this with ollydbg. However, when I try to dump the unpacked using ollydump plugin. It prompts the error "Bad DOS signature!!". Could someone ...
aMa's user avatar
  • 303
0 votes
2 answers
3k views

Automatically list of mapped memory locations(and their attributes) of a running process

I am trying to obtain the memory map of a process. One way I can think of doing this is to attach Olly/Immunity Debugger to the process and copy the memory map to the clipboard. However, this is ...
dnivra's user avatar
  • 3
1 vote
1 answer
432 views

Getting MSRs from Windows Crash Dump

I'm analyzing a crash dump BSOD on a windows box where I suspect some malware is doing something with the MSRs but it doesn't look like any of them are available via the wrmsr and rdmsr commands. Is ...
Fewmitz's user avatar
  • 1,022
2 votes
3 answers
943 views

Dumping a file loaded into memory

We have an executable that loads an XML file into memory, before parsing it into objects. When this file is loaded into memory is it possible to, break when it is loaded into memory and then somehow ...
kyndigs's user avatar
  • 123
4 votes
1 answer
1k views

An issue when unpacking UPX

Since I love to play with the WinAPI or debugging in general, I decided to write a small unpacker for the open source PE executable packer UPX today (Windows version). In order to accomplish this, I ...
beta's user avatar
  • 143
1 vote
0 answers
410 views

beginner hardware sniffing question

this is not going to be a specific question but here goes. Ive just started reading about reverse engineering for the 3ds. Is it possible to open the 3ds up and connect a probe somewhere on the chip ...
user2263800's user avatar
4 votes
3 answers
11k views

Dumping firmware through mtdblock device

This is my first attempt at doing some reverse engineering. I'm trying to dump the filesystem off a huawei hg523a TalkTalk router. The problem is its quite limited in the amount of programs that are ...
Xtrato's user avatar
  • 53
4 votes
2 answers
2k views

How does Ollydbg obtain the memory map (alt+m)? [closed]

I've been looking for any Windows functions to view or dump memory, or the process to do this manually. I can not find info on this anywhere online. How would I get a dump of a process's memory like ...
douggard's user avatar
  • 193
6 votes
1 answer
201 views

Where are program resources stored in a CIL assembly?

In a CIL assembly, where are resources stored? I am trying to reverse engineer a sample that appears to be protected by a .NET crypter. The CIL assembly for the sample does a SHA256 decryption on a ...
bobby_analog's user avatar
5 votes
2 answers
1k views

windbg crashdump process by pid from kernel

What is the best way to dump user space process by pid debugging the kernel with windbg? I'm able to attach to the process from user-space with windbg and generate crash by .dump, but how would I do ...
gljiva's user avatar
  • 51