Programul ce poate extrage date din memoria RAM

[say3er.]

ATC-NY a anuntat in cursul zilei de vineri, un program numit Mem Marshal ce poate permite accesarea mai multor informatii chiar din memoria RAM.

http://adpres.ro/programul-ce-poate-extrage-date-din-memoria-ram/

[phreak]

Ma indoiesc ca are acces 'direct' la ram, cel mai probabil foloseste ce folosesc si celelate 10000 aplicatii care citesc memoria proceselor si anume iterare memory pages + readprocessmemory din winapi.

[Guest Kovalski]

^ shh, asta extrage direct din RAM

[SticKyWoX]

Awesome! Let the hacking begin!

Va dati seama cate putem face cu programele de genu'?

Are un potential urias.

[sicilianul]

Cred ca au facut o greseala cand l-au dat asa la mana libera. Criminalistii se foloseau de astea de multisor.

Detaliile fac totul, pagina oficiala: http://www.memmarshal.com/

Edited August 4, 2012 by sicilianul

[Nytro]

cat /dev/mem > ~/dump.bin

Bine, de la 2.6 am citit ca nu mai merge chiar brut, e restrictionat.

[connected]

qiq.ws- PassMark OSForensics 1.1.1002 + patch id505846 ??? ??????? ????????? - ????? - ???? - portable - ?????? - ?????? ??????? torrent

EnCase Forensic 4.20 With Maunal & Crack : ??????? http, ftp, download : ??????? torrent id107221 : ??? ??????? ????????? - ????? - ???? - portable - ?????? - ?????? ??????? torrent

ambele sustin extragerea informatie din ram. bafta

[gh551]

EnCase Forensic e folosit de cei de la crima organizata de la noi.

[Usr6]

@nytro:

dd if=\\.\Device\PhysicalMemory of=memory.bin bs=4096 Acquisition dd

//

nu cred ca face nimic in plus fata de toolurile deja existente, ex volatility:

The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples.

Capabilities

The Volatility Framework currently provides the following extraction capabilities for memory samples

Image date and time

Running processes

Open network sockets

Open network connections

DLLs loaded for each process

Open files for each process

Open registry handles for each process

A process' addressable memory

OS kernel modules

Mapping physical offsets to virtual addresses (strings to process)

Virtual Address Descriptor information

Scanning examples: processes, threads, sockets, connections,modules

Extract executables from memory samples

Transparently supports a variety of sample formats (ie, Crash dump, Hibernation, DD)

Automated conversion between formats

https://www.volatilesystems.com/default/volatility#overview

volatility - An advanced memory forensics framework - Google Project Hosting