7
votes
Accepted
What is this hidden stack used by syscalls on Windows?
This doesn't happen during the system call. It happens in user-mode.
WOW64 processes have two user-mode stacks - a 32-bit stack, which is the one you normally use, and a 64-bit stack. The WOW64 ntdll ...
- 682
4
votes
Volatility - manually inspect heap of a process
So your question is somewhat vague. However, even without providing additional information of your target system, version and used profile, I try to give an introductive answer for Windows systems.
...
- 1,257
4
votes
Accepted
Load process from memory dump
What you want exists and is known -- among other terms -- under the term "time travel debugging" (TTD), "replay debugging" and "record and replay debugging". Your ...
- 10.9k
3
votes
Accepted
Decoding algorithm with checksum
Looks like it's just addition for the checksum, so nice job on that.
The mystery byte is part of the checksum.
The accumulator is 2 bytes.
data = """...
- 878
3
votes
Accepted
How to navigate Disassembly view to the current instruction location?
Normally the debugger should pause at the location where breakpoint is triggered, or you can use "jump to EIP" or similar command to navigate to the instruction being executed (which should be the one ...
- 36.9k
2
votes
Memory dump analysis
If you only want the firmware, you can find it in this link.
And this link might be of use. Apparently the chip on your box is a BCM3361, a MIPS32 according to Broadcom. I think you can emulate it ...
- 2,673
2
votes
Accepted
Memory dump analysis
I believe binwalk gave false postive output
It is likely the output is not false positive. You can see the strings used in certificates.
For instance I know that there are firmwares that are ...
- 619
2
votes
Accepted
Save injected code
So your definition of a "snapshot" is somewhat vague. Hopefully my answer matches your idea:
Did you already take a look at the OllyDumpEx Plugin?
This plugin is process memory dumper for OllyDbg ...
- 1,257
2
votes
Dump firmware from MC9S08EL32 MCU
I suggest you to look at the USBDM project which claims to support BDM (background debug mode) for the RS08 and HCS08 series, among others, which I think should be compatible with your chip.
Even ...
- 36.9k
2
votes
Dumping Memory to Raw File
you can craft a powershell script in case of emergency (no python no internet only base machine cant install anything whatever )
the code below is rubbish hack you may need to declare proper ...
- 16.5k
2
votes
Custom nanddump and nandwrite tools
Don’t know what swap is about, but spare area, or OOB area is an additional area at the end of each page storing metadata such as:
bad block markers
ECC (error checking and correcting) code
custom ...
- 36.9k
2
votes
Accepted
Finding mapped memory page flags in Radare2
use im to get the type and state
they are not deciphered like windbg can but you can get the flags
radare2
[0x7ff6c5153380]> im~0xcf39d2c000
0xcf39d2c000 +0x4000 rw- paddr=0x0000959e state=...
- 16.5k
2
votes
Accepted
How to fix Mach-O headers from a memory-dumped binary to make it usable again?
otool uses 0-based indexing for load commands and section numbers so it's probably the next section which is problematic.
Note that the OS loader only uses segments for mapping the image to the memory ...
- 36.9k
2
votes
Accepted
Reversing C# exe,Questions.Help
Those numbers are metadata and is called Token IDs. You can click on those in the dnSpy and you will be taken to the editor of the selected item.
As for your first question, remember that .net apps ...
- 4,942
1
vote
Decode a Windows CE nand dump
Windows CE runs in memory and isn't designed to be run from storage like normal Windows, the NAND chip only contains the binary to load into memory and sometimes the file to define the binary to load ...
- 11
1
vote
recovering a process dump from a memory dump with WinDbg
As I Commented the Address You are pointing to is not the start of process
it is the address of EPROCESS block for the process
kd> ? @$proc
Evaluate expression: -2063161104 = 8506a8f0
kd> !...
- 16.5k
1
vote
Does opening a crash dump run a file in memory?
In short, yes it is safe. The debuggers won't map crash dumps into executable memory, and extensions such as .call only work in live debugging.
- 861
1
vote
Accepted
Extract certificate information of a process from memory dump
In short, the PE loader does not explicitly load up the certificate details into the new process at run-time.
In the binary, the certificates are referenced via the IMAGE_DIRECTORY_ENTRY_SECURITY ...
- 861
1
vote
Detecting and reading embedded filesystems on desktop Linux
Try using binwalk -e yourdump.bin. It will then try to extract the files within your dump and if a filesystem is found it will also extract those.
- 111
1
vote
I have a 16GB memory dump from Belkasoft RAM Capture, what free tools can I use to analyze it?
Tools the can be used to analyze these files include
Belkasoft Evidence Cente can extract remnants of conversations and communications occurring in social networks, chat rooms, multi-player online ...
- 1,267
1
vote
How can you dump the unpacked version of a packed library/plugin from memory on macOS?
Basically you need to find the Mach-O header of the module in memory and dump the segments referred by it.
Here’s a tool which is not specifically for macOS, but should not be too difficult to modify ...
- 36.9k
1
vote
Accepted
bad memory mapping in case of MEMORY dump IDA <-> WinDbg
Use the following from idapython:
import ida_dbg
ida_dbg.edit_manual_regions()
- 228
1
vote
Can a program's memory be dumped and then reinserted?
Actually, I think this should technically be possible, without having put too much thought into it. Freeze all threads, save thread context state for all of them, enumerate all of the memory used by ...
- 1,391
1
vote
Accepted
Get NonPagedPool (NPP) Base Address on any Windows OS
I found the solution when reading these two articles:
https://pentest-tools.com/blog/bluekeep-exploit-metasploit/ (Extracting the NPP Address)
https://medium.com/@alexandrevvo/testing-bluekeep-cve-...
- 131
1
vote
Using NAND flash dump with OOB data
It depends. For example Samsung XSR stores information about the blocks in spare area, thus you need to have to dump both data and spare.
- 1,850
1
vote
Using NAND flash dump with OOB data
This depends very much on how exactly you plan to write the data back; some options would accept only "payload", others may need OOB too.
If you use U-Boot's nand write, it seems it accepts data ...
- 36.9k
1
vote
How can I resolve dynamic addresses (for APIs,DLLs etc.) to disassemble in IDA Pro?
you could write a script which will get all xref's toGetProcAddressthen go one by one to checkGetProcAddress second parametes lpProcName next follow disassembly trace return value eax to first memory ...
- 367
1
vote
Accepted
Dumping Memory to Raw File
I have recently made an API in python to read and write memory - could be useful for a quick solution.
https://github.com/samsonpianofingers/pymem
you could use this like this
import pymem
handle = ...
- 196
1
vote
Dumping SQLITE database out of memory and viewing without original DB
A Hex Editor that supports binary templates to parse and view data is probably the best tool to view where a sqlite database starts and ends. Then you can copy these hex bytes out to a seperate file ...
- 3,283
Only top scored, non community-wiki answers of a minimum length are eligible