Skip to content

Instantly share code, notes, and snippets.

@ssnkhan

ssnkhan/vboxmemdump.sh

Created October 27, 2021 19:18
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save ssnkhan/60a2ab79480bd966876aac5d2c6c2e68 to your computer and use it in GitHub Desktop.
Save ssnkhan/60a2ab79480bd966876aac5d2c6c2e68 to your computer and use it in GitHub Desktop.
Download ZIP
Dump volatile memory from a running VirtualBox VM
Raw
vboxmemdump.sh
#!/bin/bash
#Simple script for VirtuaBox memory extraction
# Usage: vboxmemdump.sh <VM name>
# See https://www.andreafortuna.org/2017/06/23/how-to-extract-a-ram-dump-from-a-running-virtualbox-machine/
VBoxManage debugvm $1 dumpvmcore --filename=$1.elf
size=0x$(objdump -h $1.elf|egrep -w "(Idx|load1)" | tr -s " " | cut -d " " -f 4)
off=0x$(echo "obase=16;ibase=16;`objdump -h $1.elf|egrep -w "(Idx|load1)" | tr -s " " | cut -d " " -f 7 | tr /a-z/ /A-Z/`" | bc)
head -c $(($size+$off)) $1.elf|tail -c +$(($off+1)) > $1.raw
rm $1.elf
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment