Skip to main content
4 votes

Binwalk extracted images corrupt?

Binwalk does carving, it doesn't care if embeedded file maybe cut into pieces, and its the parts are not stored in the container file continuously. It just finds JFIF header and tries to guess the ...
Anton Kukoba's user avatar
  • 1,850
4 votes

Volatility - manually inspect heap of a process

So your question is somewhat vague. However, even without providing additional information of your target system, version and used profile, I try to give an introductive answer for Windows systems. ...
knx's user avatar
  • 1,257
4 votes
Accepted

Extracting threads' stack from Windows memory dump

I am Not Sure what you are looking for let me try i have a dump file of a vm too MEMORY.dmp from a vm that ran xp sp3 created using .crash from a kernel debugger attached to it i loaded it ...
blabb's user avatar
  • 16.4k
3 votes
Accepted

Trying to identify a file format for CTF forensics challenge

Returning to this challenge after a bit, and Paweł Łukasik's comment turned out to be key. The presence of repeated PK sequences was the clue that this was actually a ZIP file. Ran unzip on the file - ...
BronzeOtter's user avatar
3 votes

How would I go about imaging a propriatary flash or eeprom memory chip?

I am no expert in the matter but that seems highly unlikely. There are 2 ways how to approach that I know of: detect/exploit/sniff known interface Like SPI,JTAG,... or even memory interface (address,...
Spektre's user avatar
  • 1,384
3 votes
Accepted

Can I reverse engineer a pdf file to identify the creator's name?

The PDF format is not based on XML but uses a PostScript-inspired dictionary format for its "objects" and streams for other data such as images. There are following places where document metadata is ...
Igor Skochinsky's user avatar
  • 36.8k
2 votes

Tools for Windows 10 hiberfil.sys file analysis

We recently added a "Free Mode" to Hibernation Recon which will extract the active contents from your Windows hibernation files (legacy or modern formats) into physical memory dumps. You will also get ...
Mark Spencer's user avatar
1 vote
Accepted

Extract certificate information of a process from memory dump

In short, the PE loader does not explicitly load up the certificate details into the new process at run-time. In the binary, the certificates are referenced via the IMAGE_DIRECTORY_ENTRY_SECURITY ...
josh poley's user avatar
1 vote

Reverse Engineering Flat Data File

This is not an answer, just a suggestion what you can explore next. The file seems to be a simple sequence of blocks like this: +00000 [4 bytes] block tag/id +00004 [4 bytes] block length +00008 [...
zxxc's user avatar
  • 233
1 vote

Tools for Windows 10 hiberfil.sys file analysis

It looks like the commercial EnCase Forensics supports Windows 10 to some extent since version 7.12 (they're now at 8). You might want to check it out with them. The Moonsols Windows Memory Toolkit ...
NirIzr's user avatar
  • 11.8k

Only top scored, non community-wiki answers of a minimum length are eligible