Memory dump
We can easily view the contents of a memory location with the memory dump. We can use Immunity Debugger or pwndbg for this.
How to do it...
Follow the steps for better understanding of memory dump:
- Open an application in the Immunity Debugger.
- If you want to view the memory dump in ESI register and right-click on the address and select the
Follow in Dumpoption:
- This will update the memory dump window in the bottom-left corner. The memory dump window in Immunity Debugger looks as follows:
- With
pwndbgwe can get the memory dump with thehexdumpcommand. For that, load the application ingdband run it with a breaker:
pwndbg> break 5pwndbg> run
- Now to view the memory dump in RSI register, run the following command:
pwndbg> hexdump $rsiThe output will be as follows:
