I am somewhat new to mining memory and looking for plaintext/ciphertext so I thought I would reach out and ask you all some questions.

First of all, I wrote a script that automatically dumps the heap or stack of any current running processes as long as you are the owner of said processes. There are registers, unprotected memory segments, and just so much to digest. So, if I were someone with bad intentions what would be the keywords/strings that I would look for in order to obtain the data such as passwords, command history, etc? You can easily see /shadow or /passwd in plaintext for some processes (bash for example) but, what I really want to know is the most vulnerable parts of a process.

My goal here is to really understand memory/registers and start learning Return-oriented programming in order to add data/objects to instantiated code.

Edit: So, it seems that I am not being specific enough so, let me try and narrow down my question. I am looking within specific register R5, R6, R7, R8, and a few different registries RPi, and RSi. To see what data may reside within volatile memory. My question is that which registers, let's say a BASH session for arguments sake, contain cleartext password, usernames, etc that may be something that is worth investigating advancted protection for.

closed as too broad by Steve, Steffen Ullrich, Serge Ballesta, schroeder Mar 21 '17 at 7:55

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • passwd and shadow are already in plaintext on the filesystem. If you are in the user's context, then you can read the bash command history in plaintext, too, from the file system. What is going to be the vulnerable parts of a process is going to be up to each individual process, won't it? I think this is too undefined and too broad to answer. – schroeder Mar 21 '17 at 7:55
  • Using a BASH session as an example, I know that you can see real-time commands by mining the R8 register without the using knowing. What I am trying to figure out, without grabbing the /tmp/bash_history or /home/.bash_history file is if I can see those commands that are within volitle memory considering the BASH commands themselves are not writing toe the users home directory folder until shutdown or logoff and the commands are stored in volatile memory up until that point. – Joshua Faust Mar 21 '17 at 18:23

Browse other questions tagged or ask your own question.