I have a huge memory image I'm investigating and digging through (64gb+). Too large to load into memory/vim. I ran strings on the memory file with the offsets included and saved it to a file so that I can search for the indicators I'm interested in. Example output:
332327467 Washington1 332327514 Redmond1 332327536 Microsoft Corporation1
How do I take one of those offsets and print out that specific area in memory? Ideally +/- 10 lines from it (if there are even lines in memory). I THINK I've seen dd or xxd do it but I'm not sure.
Edit: Ultimately my successful work flow turned into:
strings --radix=d mem.dump >> mem.asc strings --radix=d -el mem.dump >> mem.uni grep "blah" mem.asc *or* mem.uni *grab offset from beginning of line* dd if=mem.dump bs=1 skip=*offset here* count=100 | xxd
Subtracting from the offset to go backwords slightly if needed, and changing count= to go forward if needed.