Skip to content

Instantly share code, notes, and snippets.

@andreafortuna

andreafortuna/vboxmemdump.sh

Last active October 6, 2020 22:56
Show Gist options
  • Star 3 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save andreafortuna/fa627fb06e8ddb509c0b5b244d07433e to your computer and use it in GitHub Desktop.
Save andreafortuna/fa627fb06e8ddb509c0b5b244d07433e to your computer and use it in GitHub Desktop.
Download ZIP
Raw
vboxmemdump.sh
#!/bin/bash
#Simple script for VirtuaBox memory extraction
# Usage: vboxmemdump.sh <VM name>
VBoxManage debugvm $1 dumpvmcore --filename=$1.elf
size=0x$(objdump -h $1.elf|egrep -w "(Idx|load1)" | tr -s " " | cut -d " " -f 4)
off=0x$(echo "obase=16;ibase=16;`objdump -h $1.elf|egrep -w "(Idx|load1)" | tr -s " " | cut -d " " -f 7 | tr /a-z/ /A-Z/`" | bc)
head -c $(($size+$off)) $1.elf|tail -c +$(($off+1)) > $1.raw
rm $1.elf
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment