O'Reilly logo

Memory Dump Analysis Anthology, Volume 7 by Dmitry Vostokov

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Pre-Obfuscation Residue

This pattern is closely linked to packed and/or obfuscated code. Depending on a level of obfuscation and/or packing some initial code and data structures and patterns including fragments of strings may leak in post-obfuscation data giving a clue to intended software behavior:

0:000> s-sa 00000000`00fd4000 L6000
[...]
00000000`00fd943d  "o__"
00000000`00fd9449  "91!We"
00000000`00fd945d  "H5!"
00000000`00fd94d2  "zQ@"
00000000`00fd94dd  "ommandS"
00000000`00fd94f4  "IsDeb"
00000000`00fd94fd  "uggerP"
00000000`00fd9507  "Enc"
00000000`00fd950c  "v)3Po4t"
00000000`00fd9515  "DeXU"
00000000`00fd9520  "xFe"
00000000`00fd952a  "5Eb"
00000000`00fd9533  "SI=l8kev"
00000000`00fd953e  "Z_1m"
00000000`00fd9547  "@IF"
[...]

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required