2

I have a huge memory image I'm investigating and digging through (64gb+). Too large to load into memory/vim. I ran strings on the memory file with the offsets included and saved it to a file so that I can search for the indicators I'm interested in. Example output:

332327467 Washington1 
332327514 Redmond1 
332327536 Microsoft Corporation1

How do I take one of those offsets and print out that specific area in memory? Ideally +/- 10 lines from it (if there are even lines in memory). I THINK I've seen dd or xxd do it but I'm not sure.

Edit: Ultimately my successful work flow turned into:

strings --radix=d mem.dump >> mem.asc
strings --radix=d -el mem.dump >> mem.uni
grep "blah" mem.asc *or* mem.uni
*grab offset from beginning of line*
dd if=mem.dump  bs=1 skip=*offset here* count=100 | xxd

Subtracting from the offset to go backwords slightly if needed, and changing count= to go forward if needed.

1

If you want to use dd, you can use skip=
bs is how much to read/write at a time, offset=bs*skip. Count is how many times to read/write.
Example:

$ dd if=input of=output bs=1 skip=332327467 count=128
  • Thanks! Does this stop after a certain amount of bytes? I think it's skipping to the right spot but it keeps going until the EOF. – Thisisstackoverflow Nov 2 '16 at 22:37
  • I think count=X is my solution. Thank you again! – Thisisstackoverflow Nov 2 '16 at 23:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.