Skip to main content
7 votes
Accepted

What is this hidden stack used by syscalls on Windows?

This doesn't happen during the system call. It happens in user-mode. WOW64 processes have two user-mode stacks - a 32-bit stack, which is the one you normally use, and a 64-bit stack. The WOW64 ntdll ...
conio's user avatar
  • 672
4 votes

Volatility - manually inspect heap of a process

So your question is somewhat vague. However, even without providing additional information of your target system, version and used profile, I try to give an introductive answer for Windows systems. ...
knx's user avatar
  • 1,257
4 votes
Accepted

Load process from memory dump

What you want exists and is known -- among other terms -- under the term "time travel debugging" (TTD), "replay debugging" and "record and replay debugging". Your ...
0xC0000022L's user avatar
  • 10.9k
3 votes
Accepted

Decoding algorithm with checksum

Looks like it's just addition for the checksum, so nice job on that. The mystery byte is part of the checksum. The accumulator is 2 bytes. data = """...
pythonpython's user avatar
3 votes
Accepted

How to navigate Disassembly view to the current instruction location?

Normally the debugger should pause at the location where breakpoint is triggered, or you can use "jump to EIP" or similar command to navigate to the instruction being executed (which should be the one ...
Igor Skochinsky's user avatar
  • 36.7k
3 votes

How would I go about imaging a propriatary flash or eeprom memory chip?

I am no expert in the matter but that seems highly unlikely. There are 2 ways how to approach that I know of: detect/exploit/sniff known interface Like SPI,JTAG,... or even memory interface (address,...
Spektre's user avatar
  • 1,384
2 votes

Memory dump analysis

If you only want the firmware, you can find it in this link. And this link might be of use. Apparently the chip on your box is a BCM3361, a MIPS32 according to Broadcom. I think you can emulate it ...
yaspr's user avatar
  • 2,673
2 votes
Accepted

Memory dump analysis

I believe binwalk gave false postive output It is likely the output is not false positive. You can see the strings used in certificates. For instance I know that there are firmwares that are ...
Vladislav Ivanov's user avatar
2 votes
Accepted

Save injected code

So your definition of a "snapshot" is somewhat vague. Hopefully my answer matches your idea: Did you already take a look at the OllyDumpEx Plugin? This plugin is process memory dumper for OllyDbg ...
knx's user avatar
  • 1,257
2 votes

Dump firmware from MC9S08EL32 MCU

I suggest you to look at the USBDM project which claims to support BDM (background debug mode) for the RS08 and HCS08 series, among others, which I think should be compatible with your chip. Even ...
Igor Skochinsky's user avatar
  • 36.7k
2 votes

Dumping Memory to Raw File

you can craft a powershell script in case of emergency (no python no internet only base machine cant install anything whatever ) the code below is rubbish hack you may need to declare proper ...
blabb's user avatar
  • 16.4k
2 votes
Accepted

Reversing C# exe,Questions.Help

Those numbers are metadata and is called Token IDs. You can click on those in the dnSpy and you will be taken to the editor of the selected item. As for your first question, remember that .net apps ...
Paweł Łukasik's user avatar
2 votes

Custom nanddump and nandwrite tools

Don’t know what swap is about, but spare area, or OOB area is an additional area at the end of each page storing metadata such as: bad block markers ECC (error checking and correcting) code custom ...
Igor Skochinsky's user avatar
  • 36.7k
2 votes
Accepted

Finding mapped memory page flags in Radare2

use im to get the type and state they are not deciphered like windbg can but you can get the flags radare2 [0x7ff6c5153380]> im~0xcf39d2c000 0xcf39d2c000 +0x4000 rw- paddr=0x0000959e state=...
blabb's user avatar
  • 16.4k
2 votes
Accepted

How to fix Mach-O headers from a memory-dumped binary to make it usable again?

otool uses 0-based indexing for load commands and section numbers so it's probably the next section which is problematic. Note that the OS loader only uses segments for mapping the image to the memory ...
Igor Skochinsky's user avatar
  • 36.7k
1 vote

Decode a Windows CE nand dump

Windows CE runs in memory and isn't designed to be run from storage like normal Windows, the NAND chip only contains the binary to load into memory and sometimes the file to define the binary to load ...
doge guide's user avatar
1 vote

I have a 16GB memory dump from Belkasoft RAM Capture, what free tools can I use to analyze it?

Tools the can be used to analyze these files include Belkasoft Evidence Cente can extract remnants of conversations and communications occurring in social networks, chat rooms, multi-player online ...
chentiangemalc's user avatar
1 vote

recovering a process dump from a memory dump with WinDbg

As I Commented the Address You are pointing to is not the start of process it is the address of EPROCESS block for the process kd> ? @$proc Evaluate expression: -2063161104 = 8506a8f0 kd> !...
blabb's user avatar
  • 16.4k
1 vote

Does opening a crash dump run a file in memory?

In short, yes it is safe. The debuggers won't map crash dumps into executable memory, and extensions such as .call only work in live debugging.
josh poley's user avatar
1 vote
Accepted

Extract certificate information of a process from memory dump

In short, the PE loader does not explicitly load up the certificate details into the new process at run-time. In the binary, the certificates are referenced via the IMAGE_DIRECTORY_ENTRY_SECURITY ...
josh poley's user avatar
1 vote

Detecting and reading embedded filesystems on desktop Linux

Try using binwalk -e yourdump.bin. It will then try to extract the files within your dump and if a filesystem is found it will also extract those.
Robert Larsen's user avatar
1 vote

How can you dump the unpacked version of a packed library/plugin from memory on macOS?

Basically you need to find the Mach-O header of the module in memory and dump the segments referred by it. Here’s a tool which is not specifically for macOS, but should not be too difficult to modify ...
Igor Skochinsky's user avatar
  • 36.7k
1 vote

Using NAND flash dump with OOB data

It depends. For example Samsung XSR stores information about the blocks in spare area, thus you need to have to dump both data and spare.
Anton Kukoba's user avatar
  • 1,850
1 vote

Using NAND flash dump with OOB data

This depends very much on how exactly you plan to write the data back; some options would accept only "payload", others may need OOB too. If you use U-Boot's nand write, it seems it accepts data ...
Igor Skochinsky's user avatar
  • 36.7k
1 vote
Accepted

bad memory mapping in case of MEMORY dump IDA <-> WinDbg

Use the following from idapython: import ida_dbg ida_dbg.edit_manual_regions()
eyal karni's user avatar
1 vote

Can a program's memory be dumped and then reinserted?

Actually, I think this should technically be possible, without having put too much thought into it. Freeze all threads, save thread context state for all of them, enumerate all of the memory used by ...
Johann Aydinbas's user avatar
1 vote
Accepted

Get NonPagedPool (NPP) Base Address on any Windows OS

I found the solution when reading these two articles: https://pentest-tools.com/blog/bluekeep-exploit-metasploit/ (Extracting the NPP Address) https://medium.com/@alexandrevvo/testing-bluekeep-cve-...
Ihab's user avatar
  • 131
1 vote

How can I resolve dynamic addresses (for APIs,DLLs etc.) to disassemble in IDA Pro?

you could write a script which will get all xref's toGetProcAddressthen go one by one to checkGetProcAddress second parametes lpProcName next follow disassembly trace return value eax to first memory ...
krusty's user avatar
  • 367
1 vote
Accepted

Dumping Memory to Raw File

I have recently made an API in python to read and write memory - could be useful for a quick solution. https://github.com/samsonpianofingers/pymem you could use this like this import pymem handle = ...
Samson's user avatar
  • 196
1 vote

Dumping SQLITE database out of memory and viewing without original DB

A Hex Editor that supports binary templates to parse and view data is probably the best tool to view where a sqlite database starts and ends. Then you can copy these hex bytes out to a seperate file ...
Remko's user avatar
  • 3,273

Only top scored, non community-wiki answers of a minimum length are eligible