3

I am trying to analyze memory dumps from specific processes on the MacOS. I am using commands:

lldb --attach-pid 1041
process save-core "core"

And the size of the file core is 3.3GB. With the same application process on Windows I've go 150 MB and on linux 600 MB. Makes it hard to analyze it at that size.

What are reliable tools for the analyzing mem-dumps on MacOS, regarding looking for the sensitive data?

Improve this question
3
  • 1
    You had two questions in there, I edited it down to one ("Why" questions don't work so well, also it seems to be a side issue). What have you already done in terms of research regarding tools? What do you use on Linux?
    – nohillside ♦
    Commented Apr 15, 2021 at 11:27
  • I used xxd and grep on MacOS. However I am thinking if there is any way to improve performance of searching in so big binary files. I used also Xcode and it has problem with searching exact number of results of specific string
    – Przemekeke
    Commented Apr 15, 2021 at 11:56
  • How does size limit your analysis? Are you scrolling through it page by page in an editor? Since you already have a good answer, maybe a follow on question if you want to tick this one as answered might work best if you still need help.
    – bmike ♦
    Commented May 15, 2021 at 18:44

2 Answers 2

Reset to default
3

The reason for the memory dump being so big is that the application has mapped that much memory. It might not actually be "using" it, but it could mapped in the way of memory mapped files, or just "blank" (unused) space.

In terms of tools for analysing memory dumps, it depends entirely on what you're looking for and whether or not you know the internal data structures of the application you're analysing.

If this is a third party application, you do not have the source code for, and you're looking for sensitive data in the form of text - I would run the memory dump through the strings program:

strings core

An idea could be to save this intermediate result, and use that for later searching:

strings core > text
grep searchstring text

If you want to have a tool that actually understands the contents of the memory dump (for example to differentiate between different types of memory mappings), you can use Rekall. Note that it is unfortunately no longer maintained for macOS.

Improve this answer
12
  • That's works better thanks. The other tool which works considerably good, with GUI by the way, is Synalyze IT! It is not a third party application but mine and I am looking for weaknesses in it. I am understanding now mechanism of memory mapping and I see a lot of blank space in the HEX. Do you know maybe any possible fix for compiling it, in order to reduce the size of used memory?
    – Przemekeke
    Commented Apr 15, 2021 at 12:50
  • 1
    Mapped memory is also private. Can you share what exactly you're trying to achieve here? - You're currently using core dumps - they're intended to contain the entire mapped address space, otherwise they won't "work" (i.e. you cannot restore the process state into the debugger afterwards). It seems like you do not really want a core dump, but you should rather just dump the memory regions you're interested in into a file, and search through that.
    – jksoegaard
    Commented Apr 15, 2021 at 17:49
  • 1
    You have mentioned using Linux - in that case, you are already not dumping memory mapped files, as that is by default filtered away. You can use the /proc/<pid>/coredump_filter functionality to select what to dump (setting bit 2 and 3 will give you dumps of mapped files as well).
    – jksoegaard
    Commented Apr 15, 2021 at 17:52
  • 1
    In lldb, you can use the "memory dump" command to dump specific parts of memory. If you do not know your memory mappings, I would suggest using a tool to handle that for you.
    – jksoegaard
    Commented Apr 15, 2021 at 17:54
  • 1
    I used "vmap" to get virtual memory map on MacOS and I am able to see which memory regions are dedicated only for my application. I'll try then to dump it by "lldb". However on Linux I used "gcore" and I exclude uninterested regions by the command line option and I am wonder if it is possible on MacOS
    – Przemekeke
    Commented Apr 16, 2021 at 8:52
0

There is an excellent utility (although retired it still works): https://github.com/google/rekall/tree/master/tools/osx/MacPmem

MacPmem enables read/write access to physical memory. It simultaneously exposes a wealth of useful information about the operating system and hardware it's running on through an informational device and sysctl interface.

It exposes two devices:

/dev/pmem # Physical memory read access (can be built with write support).

/dev/pmem_info # Informational dump.

Improve this answer
1
  • 1
    Can you expand a bit with an edit? Link only answers tend to be removed.
    – Allan
    Commented Aug 3, 2023 at 20:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .