Hot answers tagged dump
7
Here is a eHow page on How to Dump Linux Memory
Linux provides two virtual devices for this purpose, '/dev/mem' and '/dev/kmem', though many distributions disable them by default for security reasons. '/dev/mem' is linked to the physical system memory, whereas '/dev/kmem' maps to the entire virtual memory space, including any swap. Both devices work as ...
6
It's not a permission issue – Windows keeps an exclusive lock on the SAM file (which, as far as I know, is standard behavior for loaded registry hives), so it is impossible for any other process to open it.
However, recent Windows versions have a feature called "Volume Shadow Copy", which is designed to create read-only snapshots of the entire volume, ...
4
You must have crashed at one point. The size is basically equal to your RAM plus 1MB.
http://blogs.technet.com/b/askperf/archive/2008/01/08/understanding-crash-dump-files.aspx
You can set it to save less information. For more information, see this document on configuring the dump size:
http://support.microsoft.com/kb/254649
4
I would use Microsoft's debugging tool: WinDbg. It can read and automatically analyze memory dumps like yours. (The WinDbg command is aptly named: !analyze)
The tool is powerful, but quite complex. Here is a detailed HOW TO guide.
The same forum suggests BlueScreenView 1.27. I have not tried it; it's probably simpler to use, but does not give as detailed ...
4
pmap <PID>
or
strace -f -o xxx -p <PID>
might be the tools you are looking for.
pmap shows you an overview about the memory usage of the provided process. strace tracks down every action a process takes. With -f you tell strace to also consider watching over child processes and -o xxx tells strace to write the output to a file. You can ...
3
I have used Clonezilla for this purpose for quite some time. It allows you to create an image of a hard drive, archive it, and restore that image. It allows you do to this via DVD-r, hard drive, or even over the network. It's a free ISO image that you burn to a CD.
3
You can use BlueScreenView to try and analyze the dumps and add to your post the highlighted results displayed in the lower pane :
BlueScreenView scans all your minidump
files created during 'blue screen of
death' crashes, and displays the
information about all crashes in one
table. For each crash, BlueScreenView
displays the minidump filename, ...
3
Microsoft used to have a webcast video by Mark Russinovich, one of the authors of the Windows Internals book. I'm not sure if they still provide it for free, but you can see it on YouTube.
It's basically a quick intro to the tools (mostly Sysinternals + WinDebug) and techniques outlined in the Windows Internals book. It should get you going, and you can dig ...
3
http://www.phrack.org/issues.html?issue=66&id=11 describes ASUS unpacker of 1MB *.ROM files:
ASUS BIOS is based on AMI BIOS
so we used AMIBIOS BIOS Module Manipulation Utility, MMTool.exe, to
extract the Main BIOS module. Open downloaded .ROM file in MMTool,
choose to extract "Single Link Arch BIOS" module (ID=1Bh), check "In
...
3
A short answer, but...
Go to your kernel source (E.g. cd /usr/src/linux/ ) and configure the options for the next kernel (make menuconfig). Go to "Processor type and features". Enable "kernel crash dumps". (CONFIG_CRASH_DUMP=y)
Build new kernel, install.
Then read thse for more background information:
Linux-Crash-HOWTO.pdf and lkcd utils
2
I have found the answer to my question. While grawity did give me a great answer nonetheless; I must say that I have finally found out how to do this with a simple tool.
I was able to dump my SAM file with simple administrative permissions on my Windows 7 x64 fully patched machine using fgdump. You can also use Cain to do this.
2
Excert from another answer I wrote:
It is impossible for programs that simply run as software to cause system instability or crashes.
What commonly happens, especially with torrent programs is that they simply tax the system to the maximum and can make weaknesses in other areas show up.
I had this in Utorrent a while ago, it turned out to be a bad Realtek ...
2
Right click on your My Computer icon and choose Properties. Select the Advanced tab and then click the Settings... button in the Startup and Recovery area. This will show you a window with a textbox near the bottom that gives the location of the dump files. It most likely uses an environment variable (%SystemRoot% on my machine, which corresponds to my ...
2
No, the problem is that you are misunderstanding how pipes work.
In Unix pipelines, data flows from left to right (the same direction as written text in English) – the first program's output becomes the second program's input. But the pipes are unidirectional; the second program's output is not sent to the first program.
When you run sml file.sml | echo -e ...
2
Use rsnapshot, obnam, duplicity, or rdiff-backup to create backups.
Don't use dump – it works by reading the disk directly and parsing the filesystem itself; it's just not going to work with subdirectories, nor with filesystems other than ext3.
1
The log file will be %systemroot%\Minidump which is normally C:\windows\Minidump
If the files don't exist then setup your system to record them ;-
Go to Start and type in sysdm.cpl and press Enter
Click on the Advanced tab
Click on the Startup and Recovery Settings button
Ensure that Automatically restart is unchecked
Under the Write Debugging Information ...
1
This is a SYSTEM_THREAD_EXCEPTION_NOT_HANDLED bugcheck, caused by a system thread throwing an exception that was not caught.
The kernel dump is unlikely to be of use to you, unless you're secretly a kernel-ninja, but hopefully you have Windows Error Reporting on, so that the bugcheck can be triaged by someone who knows what they're doing back in Microsoft ...
1
Second Look is a good, easy way to dump memory in Linux: http://secondlookforensics.com/.
There also is a recently released kernel module you could try called LiME: http://code.google.com/p/lime-forensics/
1
Simplest is probably procdump from SysInternals.
The Debugging Tools for Windows gives more advanced options (e.g. automatically dump the process on certain conditions).
1
You mean this?
Debugging tools for Windows
You can find the dumps at: c:\windows\minidump
1
file can identify many file types by examining the file contents. Usage:
file filename
I tried to reconstruct a part of your file from the data you provided, by using:
printf '\xfe\x1F(\0SR\x89\0\0\6\0\0\0Z\0\0\0XXX.Bin 6\x12XXX.BankName s80\x12XXX.CardType1' > testfile
Unfortunately, file testfile does not give any (useful) results:
testfile: data
...
1
I would run a memory tester
http://www.memtest.org/
Download the prebuilt ISO, burn it to CD as an Image (not data), boot from that CD and run the memory test for a couple of hours or overnight to stress test the memory. If you get errors with this test you have a bad memory module, if you have more than one memory module installed remove all but one and ...
1
The STOP 0x8E error means that your RAM is bad/misconfigured. (here is an article on that error)
And also, since you're getting an error saying that memory cannot be written, that makes me think that it is the former.
Since you can get into safe mode, I would do a RAM test (such as http://www.memtest.org/) see if your RAM is faulty, and if it is, well, RAM ...
Only top voted, non community-wiki answers of a minimum length are eligible
