{"id":66854,"date":"2023-05-08T16:41:01","date_gmt":"2023-05-08T08:41:01","guid":{"rendered":"https:\/\/version-2.com\/?p=66854"},"modified":"2024-09-13T16:31:18","modified_gmt":"2024-09-13T08:31:18","slug":"dumpster-diving-application-memory","status":"publish","type":"post","link":"https:\/\/version-2.com\/zh\/2023\/05\/dumpster-diving-application-memory\/","title":{"rendered":"Dumpster diving application memory"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
\n

Penetration testers hunt for weak spots in applications so vulnerabilities can be fixed before bad actors find them. One way to find those weak spots is to inspect application memory to see if sensitive data is being stored in a way that hackers can access. In this article, we\u2019ll explain how pen testers use the memory inspection process to strengthen app security.<\/p>\n\n

\n\n\"\"What is memory inspection?\n<\/b><\/span><\/span>Applications have memories \u2014 data that is generated from application processes is then stored within the app\u2019s files, either on a device or in the cloud. If an app hasn\u2019t been set up securely, a hacker could dive into those files and retrieve sensitive data.<\/span><\/span>\n\n<\/div>\n
\n
\n

White hat hackers \u2014 the people who hunt for vulnerabilities so they can be patched \u2014 can also use these same methods for good. By searching through the memories of mobile and desktop apps, as well as inspecting the installer file contents, they can unearth potential risks and keep users safe.<\/p>\n\n

Dumping the memory<\/b><\/h2>\n

The first step in the inspection process is extracting the memory from an application. This is easily done on a Windows OS \u2014 we just open the task manager and create a dump file. On a Unix operating system, the relevant information is kept in \/proc\/<PID>\/mem<\/span> and \/proc\/<PID>\/maps<\/span>.<\/p>\n

MacOS, on the other hand, requires us to boot into recovery mode and disable System Integrity Protection. This feature protects processes from being modified or tampered with. Having done this, we can then make a process dump.<\/p>\n

Memory dumping gets a bit trickier when we approach mobile applications. Mobile devices usually require root privileges in order to extract the contents from an app\u2019s memory with the help of the Frida tool.<\/p>\n

After this step, we should be left with a \u201c.txt\u201d or a \u201c.dmp\u201d file which contains the extracted memory. It is a good idea to run this file through the \u201cstrings\u201d utility to filter human-readable strings of a particular length because the dump might contain non-ASCII characters.<\/p>\n\n

Searching for secrets<\/b><\/h2>\n

Once we have dumped the memory, we can start working with what we have. Primarily, we are now searching for information that reveals the following:<\/p>\n\n