O'Reilly logo

Memory Dump Analysis Anthology, Volume 7 by Dmitry Vostokov

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

I Memory Dump

This is both a game and serious philosophical and religious tool to guide your life. Basically you need either 32 coin flips to construct a 32-bit pointer (or 64 flips for wide coverage) or 16 flips using a dice where each throw can generate at least 2 bits. Any device can help if you can get a random pointer. Then you use your favorite memory dump and symbol files for interpretation. Double, triple and multiple dereferences from a pointer can also be used to construe a path. For example, I just played and got:

 0:000> ? 0y10010111111000100100011011100111 Evaluate expression: -1746778393 = 97e246e7 0:000> !address 97e246e7 Address 97e246e7 could not be mapped in any available regions If address is inaccessible switch to another ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required