offensive security
Dump Virtual Box Memory
A quick reminder of one of the ways of how to dump memory of a VM running on VirtualBox in Linux environment.
List Available VMs
1
cd "C:\Program Files\Oracle\VirtualBox\"
2
.\VBoxManage.exe list vms
3
​
4
...
5
"win1002 debugee" {5f176ebb-a0cc-4dc7-9c6f-988fcbcca867}
6
...
Copied!
Enable Debug Mode
Dump VM Memory
Launch the VirtualBox debug console by navigating to "Debug" menu an select "Command Line":
Once you select "Command Line", you will be presented with a console that looks like this:
memory dump will be a raw file dumped to /home/youruser directory
To create a memory dump, issue the below command (also highlighted in the above graphic):
Persistence
If you want the debug options to be always available, you can:
- export
VBOX_GUI_DBG_ENABLED=truebefore launching the VM or - put export
VBOX_GUI_DBG_ENABLED=truein your.bashrcor/etc/environment
reversing, forensics & misc - Previous
Neo4j
Next - reversing, forensics & misc
AES Encryption Using Crypto++ .lib in Visual Studio C++
Last modified 1yr ago
Copy link