Hot answers tagged dump
objdump is part of binutils.
zcat foo.sql.gz | mysql -uroot -ppassword foo This will also leave foo.sql.gz as it is.
If you have XCode Tools installed on your Mac, you can use the otool that comes with it. I believe it does pretty much what objdump is capable of.
Here is a eHow page on How to Dump Linux Memory Linux provides two virtual devices for this purpose, '/dev/mem' and '/dev/kmem', though many distributions disable them by default for security reasons. '/dev/mem' is linked to the physical system memory, whereas '/dev/kmem' maps to the entire virtual memory space, including any swap. Both devices work as ...
I would use Microsoft's debugging tool: WinDbg. It can read and automatically analyze memory dumps like yours. (The WinDbg command is aptly named: !analyze) The tool is powerful, but quite complex. Here is a detailed HOW TO guide. The same forum suggests BlueScreenView 1.27. I have not tried it; it's probably simpler to use, but does not give as detailed ...
just "right click" the process in the taskmanager and select "create memory dump"
It's not a permission issue – Windows keeps an exclusive lock on the SAM file (which, as far as I know, is standard behavior for loaded registry hives), so it is impossible for any other process to open it. However, recent Windows versions have a feature called "Volume Shadow Copy", which is designed to create read-only snapshots of the entire volume, ...
For those on Max OSX there is a bug with zcat so you'll need to use gzcat instead. gzcat foo.sql.gz | mysql -uroot -ppassword foo
pmap <PID> or strace -f -o xxx -p <PID> might be the tools you are looking for. pmap shows you an overview about the memory usage of the provided process. strace tracks down every action a process takes. With -f you tell strace to also consider watching over child processes and -o xxx tells strace to write the output to a file. You can ...
I have found the answer to my question. While grawity did give me a great answer nonetheless; I must say that I have finally found out how to do this with a simple tool. I was able to dump my SAM file with simple administrative permissions on my Windows 7 x64 fully patched machine using fgdump. You can also use Cain to do this.
You must have crashed at one point. The size is basically equal to your RAM plus 1MB. http://blogs.technet.com/b/askperf/archive/2008/01/08/understanding-crash-dump-files.aspx You can set it to save less information. For more information, see this document on configuring the dump size: http://support.microsoft.com/kb/254649
If your file is 64bits, you should use otool instead of gobjdump in binutils. On Mac OSX, gobjdump is for 32bits.
Volatility seems to be working well and is Windows and Linux compatible. From their website: Volatility supports memory dumps from all major 32- and 64-bit Windows versions and service packs including XP, 2003 Server, Vista, Server 2008, Server 2008 R2, and Seven. Whether your memory dump is in raw format, a Microsoft crash dump, hibernation file,...
Right click on your My Computer icon and choose Properties. Select the Advanced tab and then click the Settings... button in the Startup and Recovery area. This will show you a window with a textbox near the bottom that gives the location of the dump files. It most likely uses an environment variable (%SystemRoot% on my machine, which corresponds to my C:\...
Well the way to create a dump file is: gcore - Generate a core file for a running process SYNOPSIS gcore [-o filename] pid
My guess: It's most likely that "raw binary dump" actually meant a hexdump – a listing that shows each byte in the file as hexadecimal numbers, instead of (or in addition to) the byte itself. It usually looks like this: ... 00000a0: 6d65 3233 3a6d 6564 6961 7769 6b69 2d31 me23:mediawiki-1 00000b0: 2e31 352e 312e 7461 722e 677a 3132 3a70 .15.1.tar.gz12:p ...
Kernel-mode dump files There are basically three types of kernel-mode dump files: Complete memory dump Kernel memory dump Small memory dump Windows 8 introduced a fourth type: Automatic Memory Dump. The main difference between them is the size: smaller dump files will get written quickly to disk and take less space; larger dump files will contain more ...
Microsoft used to have a webcast video by Mark Russinovich, one of the authors of the Windows Internals book. I'm not sure if they still provide it for free, but you can see it on YouTube. It's basically a quick intro to the tools (mostly Sysinternals + WinDebug) and techniques outlined in the Windows Internals book. It should get you going, and you can dig ...
A short answer, but... Go to your kernel source (E.g. cd /usr/src/linux/ ) and configure the options for the next kernel (make menuconfig). Go to "Processor type and features". Enable "kernel crash dumps". (CONFIG_CRASH_DUMP=y) Build new kernel, install. Then read these for more background information: Linux-Crash-HOWTO.pdf and lkcd utils
http://www.phrack.org/issues.html?issue=66&id=11 describes ASUS unpacker of 1MB *.ROM files: ASUS BIOS is based on AMI BIOS so we used AMIBIOS BIOS Module Manipulation Utility, MMTool.exe, to extract the Main BIOS module. Open downloaded .ROM file in MMTool, choose to extract "Single Link Arch BIOS" module (ID=1Bh), check "In ...
Crash dumps don't contain document contents - generally they contain the full stack traces, error logs.
I use these procedures : Install Tools If you havn't got the windows debugging tools installed, then install the Microsoft Debugging Tools (Direct Link) Analyse The MiniDump To extract useful information out of the minidump file created: Open a command prompt (Start -> Run -> "cmd") cd \program files\debugging tools (Or wherever they are installed to) kd -...
Second Look is a good, easy way to dump memory in Linux: http://secondlookforensics.com/. There also is a recently released kernel module you could try called LiME: http://code.google.com/p/lime-forensics/
You can use BlueScreenView to try and analyze the dumps and add to your post the highlighted results displayed in the lower pane : BlueScreenView scans all your minidump files created during 'blue screen of death' crashes, and displays the information about all crashes in one table. For each crash, BlueScreenView displays the minidump filename, ...
You might want to check this out for more information: https://www.networkworld.com/news/2005/041105-windows-crash.html
Try this: cat /proc/<pid>/smaps > mem.txt This link might also help you.
No, the problem is that you are misunderstanding how pipes work. In Unix pipelines, data flows from left to right (the same direction as written text in English) – the first program's output becomes the second program's input. But the pipes are unidirectional; the second program's output is not sent to the first program. When you run sml file.sml | echo -e ...
Use rsnapshot, obnam, duplicity, or rdiff-backup to create backups. Don't use dump – it works by reading the disk directly and parsing the filesystem itself; it's just not going to work with subdirectories, nor with filesystems other than ext3.
The file was simply opened in a text editor. In this case in vi, which probably was a link to Vim. Regular ASCII characters were shown. Unprintable characters were replaced by the ^@ signs. The goal of this was to see if the file had any magic numbers in it. In this case, the file did not have any, but it contained the path to the temporary directory where ...
You need to use Process Explorer 15.3 (or higher version) from sysinternals which is aware of the architecture and creates proper dumps. Process Explorer v15.3: This major Process Explorer release includes heat-map display for process CPU, private bytes, working set and GPU columns, sortable security groups in the process properties security page, ...
Only top voted, non community-wiki answers of a minimum length are eligible