forensicsmedium

Legendary OS

hackerlab

Task: find a hidden flag inside a 1GB VMware memory dump (dump.vmem) of Windows 7 SP1. Solution: standard ASCII strings search fails because the flag is stored in UTF-16LE encoding (Windows internal format); search for the UTF-16LE byte pattern of the flag prefix to locate it in notepad.exe process memory.

$ ls tags/ techniques/
memory_forensicsvmwarenotepadvmemvolatilitystring_encodingutf16lewindows7
memory_dump_analysisutf16le_string_searchvolatility_process_listingmmap_pattern_search
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub to get started.

$ssh [email protected]