I am somewhat new to mining memory and looking for plaintext/ciphertext so I thought I would reach out and ask you all some questions.
First of all, I wrote a script that automatically dumps the heap or stack of any current running processes as long as you are the owner of said processes. There are registers, unprotected memory segments, and just so much to digest. So, if I were someone with bad intentions what would be the keywords/strings that I would look for in order to obtain the data such as passwords, command history, etc? You can easily see /shadow or /passwd in plaintext for some processes (bash for example) but, what I really want to know is the most vulnerable parts of a process.
My goal here is to really understand memory/registers and start learning Return-oriented programming in order to add data/objects to instantiated code.
Edit: So, it seems that I am not being specific enough so, let me try and narrow down my question. I am looking within specific register R5, R6, R7, R8, and a few different registries RPi, and RSi. To see what data may reside within volatile memory. My question is that which registers, let's say a BASH session for arguments sake, contain cleartext password, usernames, etc that may be something that is worth investigating advancted protection for.