Hot answers tagged

3

To examine in radare2 you can think as 'print values' and you can use: px show hexdump pxl display N lines (rows) of hexdump pxr[j] show words with references to flags and code (q=quiet) Example: > px [nBytes] @[address][offset] "Print hex 10 bytes at rbp plus 10" [0x5618eccbf77a]> px 10 @rbp+10 > ...


2

If you do not need all of the current program's state (for example the state of the stack, register values, or open handles), then you can try dumping to a new executable and setting the EntryPoint to the current EIP. OllyDumpEx (https://low-priority.appspot.com/ollydumpex/) is commonly used for this purpose for malware analysis. Despite its name, it is a ...


1

Actually, I think this should technically be possible, without having put too much thought into it. Freeze all threads, save thread context state for all of them, enumerate all of the memory used by the program and dump it alongside meta data. A problem would be stuff like open handles (files, connected sockets etc.) but for programs within a limited scope ...


Only top voted, non community-wiki answers of a minimum length are eligible