Tag Info

Hot answers tagged

22

objdump is part of binutils.


20

If you have XCode Tools installed on your Mac, you can use the otool that comes with it. I believe it does pretty much what objdump is capable of.


19

zcat foo.sql.gz | mysql -uroot -ppassword foo This will also leave foo.sql.gz as it is.


16

Here is a eHow page on How to Dump Linux Memory Linux provides two virtual devices for this purpose, '/dev/mem' and '/dev/kmem', though many distributions disable them by default for security reasons. '/dev/mem' is linked to the physical system memory, whereas '/dev/kmem' maps to the entire virtual memory space, including any swap. Both devices work as ...


10

I would use Microsoft's debugging tool: WinDbg. It can read and automatically analyze memory dumps like yours. (The WinDbg command is aptly named: !analyze) The tool is powerful, but quite complex. Here is a detailed HOW TO guide. The same forum suggests BlueScreenView 1.27. I have not tried it; it's probably simpler to use, but does not give as detailed ...


6

just "right click" the process in the taskmanager and select "create memory dump"


6

pmap <PID> or strace -f -o xxx -p <PID> might be the tools you are looking for. pmap shows you an overview about the memory usage of the provided process. strace tracks down every action a process takes. With -f you tell strace to also consider watching over child processes and -o xxx tells strace to write the output to a file. You can ...


6

It's not a permission issue – Windows keeps an exclusive lock on the SAM file (which, as far as I know, is standard behavior for loaded registry hives), so it is impossible for any other process to open it. However, recent Windows versions have a feature called "Volume Shadow Copy", which is designed to create read-only snapshots of the entire volume, ...


5

For those on Max OSX there is a bug with zcat so you'll need to use gzcat instead. gzcat foo.sql.gz | mysql -uroot -ppassword foo


4

I have found the answer to my question. While grawity did give me a great answer nonetheless; I must say that I have finally found out how to do this with a simple tool. I was able to dump my SAM file with simple administrative permissions on my Windows 7 x64 fully patched machine using fgdump. You can also use Cain to do this.


4

You must have crashed at one point. The size is basically equal to your RAM plus 1MB. http://blogs.technet.com/b/askperf/archive/2008/01/08/understanding-crash-dump-files.aspx You can set it to save less information. For more information, see this document on configuring the dump size: http://support.microsoft.com/kb/254649


3

Microsoft used to have a webcast video by Mark Russinovich, one of the authors of the Windows Internals book. I'm not sure if they still provide it for free, but you can see it on YouTube. It's basically a quick intro to the tools (mostly Sysinternals + WinDebug) and techniques outlined in the Windows Internals book. It should get you going, and you can dig ...


3

http://www.phrack.org/issues.html?issue=66&id=11 describes ASUS unpacker of 1MB *.ROM files: ASUS BIOS is based on AMI BIOS so we used AMIBIOS BIOS Module Manipulation Utility, MMTool.exe, to extract the Main BIOS module. Open downloaded .ROM file in MMTool, choose to extract "Single Link Arch BIOS" module (ID=1Bh), check "In ...


3

Well the way to create a dump file is: gcore - Generate a core file for a running process SYNOPSIS gcore [-o filename] pid


3

No, the problem is that you are misunderstanding how pipes work. In Unix pipelines, data flows from left to right (the same direction as written text in English) – the first program's output becomes the second program's input. But the pipes are unidirectional; the second program's output is not sent to the first program. When you run sml file.sml | echo -e ...


3

You can use BlueScreenView to try and analyze the dumps and add to your post the highlighted results displayed in the lower pane : BlueScreenView scans all your minidump files created during 'blue screen of death' crashes, and displays the information about all crashes in one table. For each crash, BlueScreenView displays the minidump filename, ...


3

I use these procedures : Install Tools If you havn't got the windows debugging tools installed, then install the Microsoft Debugging Tools (Direct Link) Analyse The MiniDump To extract useful information out of the minidump file created: Open a command prompt (Start -> Run -> "cmd") cd \program files\debugging tools (Or wherever they are installed to) kd ...


3

Right click on your My Computer icon and choose Properties. Select the Advanced tab and then click the Settings... button in the Startup and Recovery area. This will show you a window with a textbox near the bottom that gives the location of the dump files. It most likely uses an environment variable (%SystemRoot% on my machine, which corresponds to my ...


3

A short answer, but... Go to your kernel source (E.g. cd /usr/src/linux/ ) and configure the options for the next kernel (make menuconfig). Go to "Processor type and features". Enable "kernel crash dumps". (CONFIG_CRASH_DUMP=y) Build new kernel, install. Then read these for more background information: Linux-Crash-HOWTO.pdf and lkcd utils


3

I have used Clonezilla for this purpose for quite some time. It allows you to create an image of a hard drive, archive it, and restore that image. It allows you do to this via DVD-r, hard drive, or even over the network. It's a free ISO image that you burn to a CD.


3

Use rsnapshot, obnam, duplicity, or rdiff-backup to create backups. Don't use dump – it works by reading the disk directly and parsing the filesystem itself; it's just not going to work with subdirectories, nor with filesystems other than ext3.


3

The file was simply opened in a text editor. In this case in vi, which probably was a link to Vim. Regular ASCII characters were shown. Unprintable characters were replaced by the ^@ signs. The goal of this was to see if the file had any magic numbers in it. In this case, the file did not have any, but it contained the path to the temporary directory where ...


3

My guess: It's most likely that "raw binary dump" actually meant a hexdump – a listing that shows each byte in the file as hexadecimal numbers, instead of (or in addition to) the byte itself. It usually looks like this: ... 00000a0: 6d65 3233 3a6d 6564 6961 7769 6b69 2d31 me23:mediawiki-1 00000b0: 2e31 352e 312e 7461 722e 677a 3132 3a70 .15.1.tar.gz12:p ...


2

You need to use Process Explorer 15.3 (or higher version) from sysinternals which is aware of the architecture and creates proper dumps. Process Explorer v15.3: This major Process Explorer release includes heat-map display for process CPU, private bytes, working set and GPU columns, sortable security groups in the process properties security page, ...


2

These are both better than Windows Defragger. Raxco makes a product called PerfectDisk 12.5 Defraggler I forgot to address your free space issue. Either do like the other guy suggested and format and reload, OR Launch Services (start->run services.msc ) turn off windows update delete this folder: C:\Windows\SoftwareDistribution turn on windows ...


2

Kernel-mode dump files There are basically three types of kernel-mode dump files: Complete memory dump Kernel memory dump Small memory dump Windows 8 introduced a fourth type: Automatic Memory Dump. The main difference between them is the size: smaller dump files will get written quickly to disk and take less space; larger dump files will contain more ...


2

@slhck looked at the question, containing a vi dump. Quoting part of that here: ^@^@^@^@^@^@^@^@ò½^@^@;C:\eLecta\Server\TempRecordings\U734806R4970S3962792726.el8¢s³wÕs³w^@^@^@^@è(D On Windows, get a binary dump with HxD. Or you might just try to open the file in Notepad. Similar applies to *nix systems.


2

Crash dumps don't contain document contents - generally they contain the full stack traces, error logs.


2

Excert from another answer I wrote: It is impossible for programs that simply run as software to cause system instability or crashes. What commonly happens, especially with torrent programs is that they simply tax the system to the maximum and can make weaknesses in other areas show up. I had this in Utorrent a while ago, it turned out to be a bad Realtek ...


2

Second Look is a good, easy way to dump memory in Linux: http://secondlookforensics.com/. There also is a recently released kernel module you could try called LiME: http://code.google.com/p/lime-forensics/



Only top voted, non community-wiki answers of a minimum length are eligible