Follow the steps for better understanding of memory dump:
- Open an application in the Immunity Debugger.
- If you want to view the memory dump in ESI register and right-click on the address and select the Follow in Dump option:
- This will update the memory dump window in the bottom-left corner. The memory dump window in Immunity Debugger looks as follows:
- With pwndbg we can get the memory dump with the hexdump command. For that, load the application in gdb and run it with a breaker:
pwndbg> break 5
pwndbg> run
- Now to view ...