Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [memory-dump]

The tag has no usage guidance.

1
vote
0answers
32 views

How to dump firmware from R5F71424 MCU

I've read through the Renesas SH7417 family manual and I don't see how to extract the firmware. It has a limited boot mode that only allows writing to the MCU. Any pointers or ideas would be helpful....
3
votes
0answers
54 views

EEPROM data bytes verification

I'm investigating a tool. I have an section of an eeprom memory dump that this tool uses, shown in the figure below. By my inquiries, the two bytes highlighted in red are based on the bytes ...
0
votes
0answers
53 views

Dump flash memory data from old arcade board

I have a PCB used in a pinball machine. The PCB has a flash memory chip on it, which contains game code. When the PCB is plugged into a standard ISA slot of the game's Cyrix motherboard, data from the ...
1
vote
0answers
114 views

Microcontroller memory dump

I have a board which has STM32F103RE microcontroller. Its datasheet can be found here. Since I have found in the internet only firmware that seems to be encrypted/compressed, I'm trying to figure out ...
0
votes
0answers
36 views

Is there a Heap Memory dump plugin for IDA similar to Immunity Debuggers !heap command?

Does anyone know of such a plugin or a method to get similar results using IDA?
0
votes
1answer
117 views

Reversing C# exe,Questions.Help

I am trying to debugging c# .NET application which receives a set of doubles and keep it as DataSeries every second. I want to rewrite its dataseries before the new data comes with my own dataset. ...
0
votes
1answer
466 views

Opening Windows 10 DMP file

Which program would you success to open a Windows 10 .DMP file. I've tried OllyDbg110(32Bit) but this is the result: Do I have to use a 64bit debugger or am I on a totally wrong route?
1
vote
1answer
1k views

Volatility - manually inspect heap of a process

According to the book The Art of Memory Forensics[1], there is a heaps plugin that can extract out information from the heap memory of a process. I'm using latest version of volatility - 2.6 , but the ...
1
vote
1answer
248 views

How can I resolve dynamic addresses (for APIs,DLLs etc.) to disassemble in IDA Pro?

I have memory dump of injected process. But the malware load libraries/functions dynamically and I need to resolve this. For example, If malware will use createThread, first get address of this ...
2
votes
0answers
104 views

Unable to use C++ to read memory image file [closed]

I'm using winpmem to create a memory image. I would like to create an interface that would allow a user to search for various patterns in the image. I'm using C++ to open and read the file but I am ...
0
votes
0answers
414 views

Trying to dump an assembly .NET

I have an application made in mono. Someone is injecting a dll to make "bad things". I've been able to detect it because it adds an event to AppDomain and with some reflection I detect the assembly. ...
1
vote
0answers
49 views

Trying to read/write an Renesas's M30626FHPGP flash memory

I need to make a little introduction: I'm a 37 years old man who is affected by multiple sclerosis. My neurologist gave me Rebif 44 (44mg) as a treatment. I started at full dose and went on for, ...
2
votes
1answer
284 views

Dump firmware from MC9S08EL32 MCU

I have a datasheet of the HCS08 micro-controller family from NXP. I have a Raspberry Pi and some time. I admit that this is my first time delving this deep into hardware RE, so be gentle with me. I ...
1
vote
2answers
168 views

Dumping Memory to Raw File

Is there a way to dump a section of process memory knowing the start and end address to raw bin file via a winapi function or some other method? I know that you can do this easily with a debugger, but ...
1
vote
0answers
1k views

IDA pro dump memory snapshot to file

My question is rather simple, I was analysing a piece of malware packed by some packer in IDA. I have found a memory mapped (via mmap2) region which contains the file I'm interested in. I've created a ...
0
votes
2answers
498 views

Dumping SQLITE database out of memory and viewing without original DB

I am researching some malware which loads multiple Sqlite Databases into memory during its operation. I've managed to dump the memory to disk in a large block however I cannot view the databases ...
5
votes
2answers
529 views

What is this hidden stack used by syscalls on Windows?

I've noticed there is a memory region in user mode on Windows 7 x64 WOW64 that changes during syscalls. It is located quite low in the address space and has the characteristics of a stack, i.e. it ...
0
votes
1answer
340 views

Wiring Flash Chip to Raspberry Pi

I'm trying to wire a Winbond W25Q128FV to my Rasberry Pi Model 1B so that I can dump the firmware. I'll be using an SOIC8 clip and probe cables. Here is what I'm thinking: Flash ----- rPi CS ----- ...
0
votes
2answers
564 views

Memory dump analysis

I'm trying to learn firmware analysis. The device I chosen was my Motorola SBG901 modem. I managed to dump the memory contents via JTAG using the FlashcatUSB adapter. The memory dump is about 8MB in ...
1
vote
0answers
109 views

Checksum reverse engineering help

I'm a newbie here, and I don't have a lot of experience with reverse engineering, so I'm asking for your help. I have dumped a Mifare Classic card several times, because I wanted to try understand ...
0
votes
1answer
325 views

Save injected code

I am analyzing a binary that is injecting code into another process (i.e., svchost.exe) to make the debugging more tedious. I can attach the new process to a debugger (e.g., ollydbg or the one ...
1
vote
1answer
104 views

How would I go about imaging a propriatary flash or eeprom memory chip?

I've been playing around a lot with the xeltek reader, which lets me image various memory chips. Usually, I just use the catalog number used to get the chip's datasheet and search xelteks database for ...
1
vote
0answers
79 views

Mutable parts of PE files in memory

I currently try to figure out, what actually happens to a PE File in memory. To reword it: How could PE files differ, when they run on different computers and what are the mutable parts of a PE file, ...
2
votes
0answers
441 views

How get a full memory dump of a running services.exe instance?

How can I get a full memory dump from a services.exe process on Windows 8.1 x64?
7
votes
2answers
2k views

How to Fix a memory dump of a dll - so i dynamically reverse it using olly \ ida

I need to analyze a memory dump of a malware module, unfortunately the sample is not the original dll, but the dump of the dll from the memory. Now fixing the sections headers is fairly easy - i just ...
1
vote
3answers
392 views

Dump global datas to disk in assembly code

the experiment is on Linux, x86 32-bit. So suppose in my assembly program, I need to periodically (for instance every time after executing 100000 basic blocks) dump an array in .bss section from ...