0

Is it possible to convert a full raw dump memory and open it in WinDBG ? In order to inspect if they are no malwares, filter process who call particular API, dump each process in memory etc...

2
  • Typical tools for this are Volatility or Rekall. There are some useful things you can do in WinDbg, but I’d focus on those other tools first as they can directly answer your questions.
    – David
    Feb 2 '19 at 22:55
  • If you update your question to explain what you mean by "full raw dump memory" you might get better answers.
    – hft
    Sep 25 '20 at 5:26
0

Yes, it is possible to analyze a kernel mode dump in WinDBG: https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/analyzing-a-kernel-mode-dump-file-with-windbg

But analyzing it takes a little more finesse than a per-process level dump. See how to interrogate all running processing with !process: https://docs.microsoft.com/en-us/windows-hardware/drivers/debugger/-process, etc.

2
  • unfortunately this is not a kernel dump (in .dmp file extension), this is a pure raw dump memory made by RamCapture (Belkasoft). WinDBG doesn't support raw dump. Jan 5 '19 at 8:55
  • The proprietary software is good to know. .dmp files are the de facto standard for memory forensics. It appears you have a tool that's trying to force you to only use their products as the product sheet says you need to use their proprietary tool to analyze the dump created by RAM Capturer:. belkasoft.com/ram-capturer
    – thepip3r
    Jan 7 '19 at 15:08

This site is temporarily in read only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .