Extracting RAW pictures from memory dumps
w00tsec.blogspot.com
Extracting RAW pictures from memory dumps
1–10 of 11 posts
Re: Extracting RAW pictures from memory dumps
#2pretty wild, im used to running strings on process dumps and such.. never imagined opening an image editor to get something useful!
Re: Extracting RAW pictures from memory dumps
#3Also fun to try cat'ing a process' memory to /dev/audio. Works best if the process is a media player.
Re: Extracting RAW pictures from memory dumps
#4pretty wild, im used to running strings on process dumps and such.. never imagined opening an image editor to get something useful!
I remember doing such things on Amiga with Action Replay cartridge. You could even measure heights of life bars etc. and search for memory cells containing that data.
Re: Extracting RAW pictures from memory dumps
#5In the end of the eighties I needed to replace the fancy patterns available in spreadsheet graphics on PC1512 (gem) by more serious patterns (the client was a bank). I have done a small visualisation program in turbo pascal to find them and I have patched the binary.
Re: Extracting RAW pictures from memory dumps
#6pretty wild, im used to running strings on process dumps and such.. never imagined opening an image editor to get something useful!
I remember doing such things on Amiga with Action Replay cartridge. You could even measure heights of life bars etc. and search for memory cells containing that data.
Sweet memories... sigh :)
There was also a program called ScreenJaeger [1] to grab images from memory.
[1] ftp://ftp.de.netbsd.org/aminet/gfx/misc/ScreenJaeger.readme
Re: Extracting RAW pictures from memory dumps
#7Kind of OT, but does anyone know of decent resources for learning more about and eventually correcting RAW images?
I have a collection of RAW photos that have, due to bad transfers or old disks, become corrupted in ways where you can still see the original image, but color casts are off for half the image (strong purple or orange casts) or the image will suddenly jump and skip a few hundred pixels at random places. It seems like I am just missing a portion in the middle or something is misaligned, and I'd love to get these photos back. (I know that a JPG preview is hidden inside the file, which I could extract, but it would be nice to have the full image back as well.)
Re: Extracting RAW pictures from memory dumps
#8Kind of OT, but does anyone know of decent resources for learning more about and eventually correcting RAW images? I have a collection of RAW photos that have, due to bad transfers or old disks, become corrupted in ways where you can still see the original image, but color casts are off for half the image (strong purple or orange casts) or the image will suddenly jump and skip a few hundred pixels at random places. I…
You could try applying some of the techniques used by fans to restore one of the corrupted SpaceX landing videos. Find out where in the file the first bad pixel is stored, then insert or remove bytes until the color cast is fixed, for example.
Re: Extracting RAW pictures from memory dumps
#9Kind of OT, but does anyone know of decent resources for learning more about and eventually correcting RAW images? I have a collection of RAW photos that have, due to bad transfers or old disks, become corrupted in ways where you can still see the original image, but color casts are off for half the image (strong purple or orange casts) or the image will suddenly jump and skip a few hundred pixels at random places. I…
What you mention sound like tipical corruption of JPG files with foreign data in the middle. If you have access to the disk image, commercial software like Adroit Photo Recovery could (in theory) help you. They've developed a technique for recovery of photo files that is very robust and can handle fragmentation.
On the more open source front... There's little. Adroits algorithms have been published, be the implementation is proprietary. Poisel, Tjoa and Tavolato implemented the algorithm in Python+C, but its quite difficult to get their carver up and running, mostly due to "library rot" -- last I tried, there was no repo from where to download the particular version of PyQT they used and I didn't have the time to fix and translate all the old calls to new ones.
You could also try PhotoRec, but for fragmented data it isn't the best solution. Finally, you could try custom code to try and find the JPG blocks in the images and then all the combinations until you find something that makes sense.
Welcome to the beautiful and monstrous world of file/data carving!
Re: Extracting RAW pictures from memory dumps
#10Just wanted to say I loved your off the cuff humor and thought it was an enjoyable article.