Skip to content

Dump a process memory and extract data based on regular expressions.

License

Notifications You must be signed in to change notification settings

ivan-sincek/memory-dumper

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

1 Commit
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Memory Dumper

Dump a process memory and extract data based on regular expressions. Tool uses multithreading.

Dump and inspect a process memory:

  • during inactivity in an application,
  • after locking an application,
  • after logging out from an application.

Garbage cleaners might not free the unused memory immediately, but should do so after 5-10 minutes after the last action.

CPU and RAM consumption, as well as duration heavily depends on:

  • number of memory dump files,
  • size of each memory dump file,
  • number of regular expressions and their complexity.
  • occurrence of each regular expression.

Built with Visual Studio Community 2019 v16.10.2 (64-bit) and tested on Windows 10 Enterprise OS (64-bit).

Made for educational purposes. I hope it will help!

Table of Contents

How to Run

Run MemoryDumper_x86.exe (32-bit) or MemoryDumper_x64.exe (64-bit).

Check the example file with regular expressions here.

Manual Memory Dumping

To manually dump a process memory, open Task Manager -> right click on the desired process -> click on Create dump file.

Manual Memory Inspection

The following was tested on Kali Linux v2023.1 (64-bit).

Install the required tools on your Kali Linux:

apt-get -y install strings radare2 grep

I prefer using rabin2 over strings.

rabin2

Inspect memory dump, binary, executable, or any other files:

rabin2 -zzzqq somefile | grep -Pi '(keyword-1|keyword-2|keyword-3)'

rabin2 -zzzqq somefile | sort -uf > strings.txt

Automate file inspection from the current directory:

IFS=$'\n'; for file in $(find . -type f); do echo -n "\nFILE: \"${file}\"\n"; rabin2 -zzzqq "${file}" 2>/dev/null | grep -Pi '(keyword-1|keyword-2|keyword-3)'; done

IFS=$'\n'; for file in $(find . -type f); do rabin2 -zzzqq "${file}" 2>/dev/null; done | sort -uf > strings.txt

strings

Inspect memory dump, binary, executable, or any other files:

strings somefile | grep -Pi '(keyword-1|keyword-2|keyword-3)'

strings somefile | sort -uf > strings.txt

Automate file inspection from the current directory:

IFS=$'\n'; for file in $(find . -type f); do echo -n "\nFILE: \"${file}\"\n"; strings "${file}" 2>/dev/null | grep -Pi '(keyword-1|keyword-2|keyword-3)'; done

IFS=$'\n'; for file in $(find . -type f); do strings "${file}" 2>/dev/null; done | sort -uf > strings.txt

Images

Run

Figure 1 - Run