Search Results
| Search type | Search syntax |
|---|---|
| Tags | [tag] |
| Exact | "words here" |
| Author |
user:1234 user:me (yours) |
| Score |
score:3 (3+) score:0 (none) |
| Answers |
answers:3 (3+) answers:0 (none) isaccepted:yes hasaccepted:no inquestion:1234 |
| Views | views:250 |
| Code | code:"if (foo != bar)" |
| Sections |
title:apples body:"apples oranges" |
| URL | url:"*.example.com" |
| Saves | in:saves |
| Status |
closed:yes duplicate:no migrated:no wiki:no |
| Types |
is:question is:answer |
| Exclude |
-[tag] -apples |
| For more details on advanced search visit our help page | |
Results tagged with memory-dump
Search options answers only
not deleted
user 3473
2
votes
Accepted
Finding mapped memory page flags in Radare2
use im to get the type and state
they are not deciphered like windbg can but you can get the flags
radare2
[0x7ff6c5153380]> im~0xcf39d2c000
0xcf39d2c000 +0x4000 rw- paddr=0x0000959e state=0x00001000 …
- 16.7k
2
votes
Dumping Memory to Raw File
you can craft a powershell script in case of emergency (no python no internet only base machine cant install anything whatever )
the code below is rubbish hack you may need to declare proper mana …
- 16.7k
1
vote
recovering a process dump from a memory dump with WinDbg
As I Commented the Address You are pointing to is not the start of process
it is the address of EPROCESS block for the process
kd> ? @$proc
Evaluate expression: -2063161104 = 8506a8f0
kd> !process 0 …
- 16.7k
1
vote
Dump global datas to disk in assembly code
with gdb you can define a canned sequence and execute it
a sample canned sequence could be
stepi {count} append memory {filepath} {start} {end}
a sample run on cygwin gdb over gdb
$ gdb gdb
GN …
- 16.7k
1
vote
How to Fix a memory dump of a dll - so i dynamically reverse it using olly \ ida
open the dumped file in a hexeditor say hxd
select the bytes from offset 0x400 to 0xfff and delete them
(all the bytes would be 0x00)
save the file your imports should turn out ok
pointer to raw data …
- 16.7k