akde/infosec

Click Here

  • Volatility

    See also Mem­ProcFS The foren­sic mem­o­ry frame­work Volatil­i­ty (Ver­sion 3 since 2019) offers a wide range of meth­ods to analyse mem­o­ry. See the blog post Retriev­ing mem­o­ry for meth­ods and tech­niques to obtain memory. Start by get­ting gen­er­al infor­ma­tion about a mem­o­ry dump: volatility -f image.mem imageinfo Now use the fol­low­ing com­mands to get more information:…

  • Memory dump

    After­wards: See Ana­lyz­ing memory Linux Prozess memory dump Find out which mem­o­ry seg­ments are used by an appli­ca­tion via its PID: cat /proc/<pid>/maps Dump the used mem­o­ry from an appli­ca­tion: (cred­it) #!/bin/bash grep rw-p /proc/$1/maps \ | sed -n 's/^\([0-9a-f]*\)-\([0-9a-f]*\) .*$/\1 \2/p' \ | while read start stop; do \ gdb --batch --pid $1 -ex \…