Comments on: Integrating msramdmp into your existing USB toolkit http://www.mcgrewsecurity.com/2008/03/04/integrating-msramdmp-into-your-existing-usb-toolkit/ Thu, 05 Jan 2012 11:44:23 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: complience http://www.mcgrewsecurity.com/2008/03/04/integrating-msramdmp-into-your-existing-usb-toolkit/#comment-251 complience Thu, 23 Apr 2009 23:15:46 +0000 http://www.mcgrewsecurity.com/?p=86#comment-251 er.,. so its not an error i need to worry about then? er.,. so its not an error i need to worry about then?

]]> By: admin http://www.mcgrewsecurity.com/2008/03/04/integrating-msramdmp-into-your-existing-usb-toolkit/#comment-250 admin Mon, 20 Apr 2009 22:13:00 +0000 http://www.mcgrewsecurity.com/?p=86#comment-250 complience: msramdmp dumps the entirety of memory, including msramdmp, syslinux, and all of their strings and messages :) complience:
msramdmp dumps the entirety of memory, including msramdmp, syslinux, and all of their strings and messages :)

]]> By: admin http://www.mcgrewsecurity.com/2008/03/04/integrating-msramdmp-into-your-existing-usb-toolkit/#comment-249 admin Mon, 20 Apr 2009 22:11:44 +0000 http://www.mcgrewsecurity.com/?p=86#comment-249 complience: The parts of syslinux that are used in the instructions here are already compiled in the tarball. complience:
The parts of syslinux that are used in the instructions here are already compiled in the tarball.

]]> By: complience http://www.mcgrewsecurity.com/2008/03/04/integrating-msramdmp-into-your-existing-usb-toolkit/#comment-248 complience Mon, 20 Apr 2009 21:53:28 +0000 http://www.mcgrewsecurity.com/?p=86#comment-248 At the start of my dump I see the following plaintext, any ideas whats going on? Missing operating system. f Multiple active partitions. f Operating system load error. MSRAMDMPC32 I FAT12 Boot error SYSLINUX 3.75 2009-04-16 Load error - tg< tZ< tf< It appears your computer has less than 256K of low RAM. Linux needs at least this amount to boot. If you get this message in error, hold down the Ctrl key while booting, and I will take your word for it. Invalid image type for this media type! Could not find kernel image: Invalid or corrupt kernel image. Loading Cannot load a ramdisk with an old kernel image. Could not find ramdisk image: : attempted DOS system call INT COMBOOT image too large. aborted. At the start of my dump I see the following plaintext, any ideas whats going on?

Missing operating system.
f
Multiple active partitions.
f
Operating system load error.

MSRAMDMPC32
I FAT12
Boot error

SYSLINUX 3.75 2009-04-16
Load error -
tg<
tZ<
tf<
It appears your computer has less than 256K of low
RAM. Linux needs at least this amount to boot. If you get
this message in error, hold down the Ctrl key while
booting, and I will take your word for it.

Invalid image type for this media type!

Could not find kernel image:
Invalid or corrupt kernel image.

Loading
Cannot load a ramdisk with an old kernel image.

Could not find ramdisk image:
: attempted DOS system call INT
COMBOOT image too large.

aborted.

]]> By: complience http://www.mcgrewsecurity.com/2008/03/04/integrating-msramdmp-into-your-existing-usb-toolkit/#comment-247 complience Sat, 18 Apr 2009 22:09:57 +0000 http://www.mcgrewsecurity.com/?p=86#comment-247 how are you compiling the syslinux tarball after you have extracted it? how are you compiling the syslinux tarball after you have extracted it?

]]> By: KAMAL AHLUWALIA http://www.mcgrewsecurity.com/2008/03/04/integrating-msramdmp-into-your-existing-usb-toolkit/#comment-246 KAMAL AHLUWALIA Fri, 27 Feb 2009 20:30:41 +0000 http://www.mcgrewsecurity.com/?p=86#comment-246 HI WESLEY I NEED YOUR HELP FOR COMPILING MSRAMDUMP. I AM USING UBUNTU & IT DOESN'T HAVE CONSOLE.H & COM32.H.I HAVE TRIED INSTALLING MANY PACKAGES BUT IT IS NOT WORKING,PLZ TELL ME VAT PACKAGE DO I NEED TO INSTALL. PLZZZZZZZZ... HELP HI WESLEY
I NEED YOUR HELP FOR COMPILING MSRAMDUMP.
I AM USING UBUNTU & IT DOESN’T HAVE CONSOLE.H & COM32.H.I HAVE TRIED INSTALLING MANY PACKAGES BUT IT IS NOT WORKING,PLZ TELL ME VAT PACKAGE DO I NEED TO INSTALL.
PLZZZZZZZZ… HELP

]]> By: kamal ahluwalia http://www.mcgrewsecurity.com/2008/03/04/integrating-msramdmp-into-your-existing-usb-toolkit/#comment-245 kamal ahluwalia Tue, 17 Feb 2009 11:40:41 +0000 http://www.mcgrewsecurity.com/?p=86#comment-245 hi after viewing the strings in hex editor i didnt get any kind of significant results i wanted. have you tried this by performing cold boot. i have dumped512mb of ram on 2gb usb in 15 min. do you have idea regarding pxe boot instead of usb.?? hi
after viewing the strings in hex editor i didnt get any kind of significant results i wanted.
have you tried this by performing cold boot.
i have dumped512mb of ram on 2gb usb in 15 min.
do you have idea regarding pxe boot instead of usb.??

]]> By: KAMAL AHLUWALIA http://www.mcgrewsecurity.com/2008/03/04/integrating-msramdmp-into-your-existing-usb-toolkit/#comment-244 KAMAL AHLUWALIA Tue, 17 Feb 2009 09:10:03 +0000 http://www.mcgrewsecurity.com/?p=86#comment-244 hi i have dumped 512 mb of ram on 2gb usb flash drive in approximately 15 min. for new users i would like to tell if they are getting some problems in compiling syslinux then try installing few libraries using command: apt-get install mtools lilo nasm libc6-dev netbpm One other thing if some one wants to try dumping tools are also available at Princeton univ. link including both pxe boot & usb boot: http://citp.princeton.edu/memory/code/ do you have any idea regarding extraction of keys form memory dump..???? hi
i have dumped 512 mb of ram on 2gb usb flash drive in approximately 15 min.
for new users i would like to tell if they are getting some problems in compiling syslinux then try installing few libraries using command:
apt-get install mtools lilo nasm libc6-dev netbpm
One other thing if some one wants to try dumping tools are also available at Princeton univ. link
including both pxe boot & usb boot:
http://citp.princeton.edu/memory/code/
do you have any idea regarding extraction of keys form memory dump..????

]]> By: admin http://www.mcgrewsecurity.com/2008/03/04/integrating-msramdmp-into-your-existing-usb-toolkit/#comment-243 admin Sun, 16 Nov 2008 21:54:02 +0000 http://www.mcgrewsecurity.com/?p=86#comment-243 Yes, that's actually covered in the documentation for msramdmp located here: http://www.mcgrewsecurity.com/tools/msramdmp/ Yes, that’s actually covered in the documentation for msramdmp located here:

http://www.mcgrewsecurity.com/tools/msramdmp/

]]> By: complience http://www.mcgrewsecurity.com/2008/03/04/integrating-msramdmp-into-your-existing-usb-toolkit/#comment-242 complience Fri, 14 Nov 2008 22:49:35 +0000 http://www.mcgrewsecurity.com/?p=86#comment-242 Syslinux needs a drive formatted in FAT16. CFDISK only makes a partition doesnt actually format. you need to use this command on the partition after you've made it. sudo mkdosfs -F 16 /dev/sdd1 Syslinux needs a drive formatted in FAT16.

CFDISK only makes a partition doesnt actually format.

you need to use this command on the partition after you’ve made it.

sudo mkdosfs -F 16 /dev/sdd1

]]>