1

How to search a string in the whole RAM? (not only in some processes' allocated memory, but the whole RAM)

Or is there a way to dump the whole RAM into a 4GB or 8GB disk file? Then I could easily do:

grep mypassword c:\ramdump.raw

Usage example: I'd like to know if a password manager stores my master password in plaintext, as found by a security team here.

I'm using Windows 7 x64, as administrator.


Note: Unlike How to get complete memory dump in Windows 10? I specifically want to search content in the RAM, and not get information from a memory dump. Moreover this question is unclear: the title doesn't match the content ("Question in title doesn't seem to match the question in the body.")

  • Possible duplicate: superuser.com/questions/1023640/… – Mokubai Nov 21 '19 at 10:20
  • @Mokubai No it's a bit different, here I specifically want to search content in the RAM. Moreover this question has a poor wording ("Question in title doesn't seem to match the question in the body. Which are you asking?"). – Basj Nov 21 '19 at 10:52
  • Possible duplicate of How to get complete memory dump in Windows 10? – Azevedo Nov 21 '19 at 11:05
  • @Azevedo No it's a bit different, here I specifically want to search content in the RAM. Moreover this question has a poor wording ("Question in title doesn't seem to match the question in the body. Which are you asking?") – Basj Nov 21 '19 at 11:11
2

How to I find a string anywhere in RAM?

You can use windbg (Download Debugging Tools for Windows - WinDbg - Windows drivers | Microsoft Docs) for this.

Example:

To search for a string (Error: 1002) in memory, we run the following command:

0:000> s -a 0 L?80000000 "Error: 1002"
04b0e06c  45 72 72 6f 72 3a 20 31-30 30 32 00 00 00 00 00  Error: 1002.....

...

enter image description here

Source WinDbg: search for a string – Distributed Services: Notes from the field


Further Reading

  • The commands go in the text box (console) at the bottom, to the right of the prompt 0:000> – DavidPostill Nov 21 '19 at 10:57
  • The program you are going to debug is your password manager (not notepad as in the getting started example) – DavidPostill Nov 21 '19 at 11:00
  • 1
    @Basj Then you need to configure Windows to produce a full memory dump when a program crashes - you already know how to do this. Post mortem debugging is different to run time debugging. – DavidPostill Nov 21 '19 at 11:27
  • 1
    Note that is the OS kernel code that produces the full dump as it has extra privileges that users (even system or admin) don't. You as a user (even admin) cannot just dump all memory – DavidPostill Nov 21 '19 at 11:30
1

Your best option is to use an Hex editor. Most Hex editors are developed to handle huge files. They can search for either strings or hex sequences.

Some hex editors can also dump the content of RAM, read entire RAW disks or dump them, it depends on the editor.

Have in mind that some RAM areas won't be accessible for obvious security reasons. So if you are trying to hack some password from RAM you probably won't get it. Life is not that easy.

This method is usually used to debug, not to hack.

enter image description here

  • Yes I'll use a HEX editor or grep but first I need to have a file containing the whole RAM content... How to do this? – Basj Nov 21 '19 at 10:48
  • I updated the answer. – Azevedo Nov 21 '19 at 10:52
  • As I'm the only user on computer, it's not a password hack. If I have admin rights, why can't I have access to the whole RAM? ("some RAM areas won't be accessible for obvious security reasons") – Basj Nov 21 '19 at 10:59
  • NOT POSSIBLE. It is the same to say that your bank account manager can see your password just because he is the manager. – Azevedo Nov 21 '19 at 11:03
  • It seems possible: nvidia.custhelp.com/app/answers/detail/a_id/4641/~/… – Basj Nov 21 '19 at 11:19
-1

Here are possible ways to create full memory dumps:

https://support.avast.com/en-eu/article/Windows-complete-memory-dump

https://nvidia.custhelp.com/app/answers/detail/a_id/4641/~/collecting-a-full-memory-dump-in-windows-10

The method is to add this to registry:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl]
"CrashDumpEnabled"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\kbdhid\Parameters]
"CrashOnCtrlScroll"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\i8042prt\Parameters]
"CrashOnCtrlScroll"=dword:00000001

and then to generate a crash:

Manually force a Windows crash by holding down the CTRL key on the right side of your keyboard and pressing the Scroll Lock key twice (right CTRL + 2x Scroll Lock).

I'll try then to search in the dump file with a HEX editor.

  • 1
    To the downvoter, please can you explain how to improve this answer? Or what is wrong? (I found this technique after posting my original question, after further research) – Basj Nov 21 '19 at 11:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.