qiling icon indicating copy to clipboard operation
qiling copied to clipboard

Get all memory content

Open pmondon opened this issue 4 years ago • 1 comments

Dear Qiling team,

I would like to know if there is any way to get all the memory content from a snapshot. I want to be able to parse myself all the memory to search for particular data. I see in the debug mode that all the information are present as they are displayed yet I can't find a way to get this memory. Thank you in advance for your time.

pmondon avatar Jan 31 '22 13:01 pmondon

Snapshot in theory is just a python pickle object and thus you may unpickle it by yourself. However, it looks like a design flaw since the format of the snapshot is not specified anywhere.

wtdcode avatar Jan 31 '22 13:01 wtdcode

Close for now.

We updated the codebase for Qiling and Unicorn since this issue being posted.

Feel free to try the latest version.

xwings avatar Oct 06 '22 03:10 xwings