4
votes
Accepted
Extracting threads' stack from Windows memory dump
I am Not Sure what you are looking for let me try
i have a dump file of a vm too MEMORY.dmp from a vm that ran xp sp3 created using .crash from a kernel debugger attached to it
i loaded it ...
- 16.3k
4
votes
Binwalk extracted images corrupt?
Binwalk does carving, it doesn't care if embeedded file maybe cut into pieces, and its the parts are not stored in the container file continuously. It just finds JFIF header and tries to guess the ...
- 1,840
4
votes
Volatility - manually inspect heap of a process
So your question is somewhat vague. However, even without providing additional information of your target system, version and used profile, I try to give an introductive answer for Windows systems.
...
- 1,257
3
votes
Accepted
Can I reverse engineer a pdf file to identify the creator's name?
The PDF format is not based on XML but uses a PostScript-inspired dictionary format for its "objects" and streams for other data such as images. There are following places where document metadata is ...
- 36.4k
3
votes
Accepted
Trying to identify a file format for CTF forensics challenge
Returning to this challenge after a bit, and Paweł Łukasik's comment turned out to be key. The presence of repeated PK sequences was the clue that this was actually a ZIP file. Ran unzip on the file - ...
- 363
3
votes
How would I go about imaging a propriatary flash or eeprom memory chip?
I am no expert in the matter but that seems highly unlikely. There are 2 ways how to approach that I know of:
detect/exploit/sniff known interface
Like SPI,JTAG,... or even memory interface (address,...
- 1,384
2
votes
One-pass streaming algorithm for detecting bytecode/opcode?
First of all, ARM is much easier than Intel because it has fixed instruction length, (if I remember right) requires instructions to be aligned by 2 or 4 and has limited capabilities for arbitrary code ...
- 8,418
2
votes
Tools for Windows 10 hiberfil.sys file analysis
We recently added a "Free Mode" to Hibernation Recon which will extract the active contents from your Windows hibernation files (legacy or modern formats) into physical memory dumps. You will also get ...
- 21
1
vote
Accepted
Extract certificate information of a process from memory dump
In short, the PE loader does not explicitly load up the certificate details into the new process at run-time.
In the binary, the certificates are referenced via the IMAGE_DIRECTORY_ENTRY_SECURITY ...
- 851
1
vote
Reverse Engineering Flat Data File
This is not an answer, just a suggestion what you can explore next.
The file seems to be a simple sequence of blocks like this:
+00000 [4 bytes] block tag/id
+00004 [4 bytes] block length
+00008 [...
- 233
1
vote
Tools for Windows 10 hiberfil.sys file analysis
It looks like the commercial EnCase Forensics supports Windows 10 to some extent since version 7.12 (they're now at 8). You might want to check it out with them.
The Moonsols Windows Memory Toolkit ...
- 11.7k
Only top scored, non community-wiki answers of a minimum length are eligible