I use Android emulator to analyze malcious apps and fake apps that stealing data, doing malcious, mining, rooting etc.
I usally dump RAM using GDB and GameGuardian in order to recover decrypted content dumped from RAM but problem is some devs used other 3rd party service to encrypt and add anti-dumping and anti-attach so that the app crashes itself if any app tries to attach the process.
I had an idea about dumping RAM from Vbox-based Android emulation. I used Task Manager, Cheat Engine and Microsoft tool (something called "proc"... i forgot it) to dump but it doesn't dump emulated RAM unfortunately.
Is there any tools that can dump any Vbox-based emulators, Bluestacks, Nox, Memu, LDPlayer etc?
Dump RAM from Vbox-based Android emulators?
-
- Posts: 12
- Joined: 18. Nov 2016, 18:52
-
- Site Moderator
- Posts: 39156
- Joined: 4. Sep 2008, 17:09
- Primary OS: MS Windows 10
- VBox Version: PUEL
- Guest OSses: Mostly XP
Re: Dump RAM from Vbox-based Android emulators?
Saving state will dump RAM to a file, along with hardware registers. The source code has the file format.
-
- Posts: 12
- Joined: 18. Nov 2016, 18:52
Re: Dump RAM from Vbox-based Android emulators?
Is there more infomation about it?mpack wrote:Saving state will dump RAM to a file, along with hardware registers. The source code has the file format.
Are files plain inside dumped file and can it be extracted/recovered using Winhex, 010 editor?
-
- Site Moderator
- Posts: 39156
- Joined: 4. Sep 2008, 17:09
- Primary OS: MS Windows 10
- VBox Version: PUEL
- Guest OSses: Mostly XP
Re: Dump RAM from Vbox-based Android emulators?
No there is nothing else. The source code is the only source of data for implementation details, if for no other reason that it can be changed at any time.
-
- Posts: 12
- Joined: 18. Nov 2016, 18:52
Re: Dump RAM from Vbox-based Android emulators?
Well too bad, i'll do bypass way then.mpack wrote:No there is nothing else. The source code is the only source of data about for implementation details, if for no other reason that it can be changed at any time.