skills.rest
dslsdzc
dslsdzcCOMMUNITY
Explore all skills by this author →
GitHub

re-memdump

Dump process memory with gcore and extract keys, DEX files, and decrypted data.

64|9|Updated Aug 17, 2026
Search Tags:#reverse engineering#memory dump#forensics#unpacking#core dump#key extraction#gcore
One-click install
npx skills add https://github.com/dslsdzc/rev-skills --skill re-memdump-dslsdzc
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: re-memdump
Source: https://github.com/dslsdzc/rev-skills/tree/main/.claude/skills/re-memdump
Command: npx skills add https://github.com/dslsdzc/rev-skills --skill re-memdump-dslsdzc

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Reading live process memory is error-prone: dumps taken before unpacking capture only the packer's initial state, direct /proc/pid/mem reads fail without proper addressing, and decrypted data vanishes moments after it appears. This Skill provides a dump-first workflow for reliably capturing and extracting memory artifacts. ## Core Features & Use Cases - Dump-first memory capture: Uses gcore/gdb as the default path, with /proc/pid/mem direct reads reserved for special cases (process must stay running, tiny target regions), plus procdump/DumpIt coverage on Windows. - Targeted extraction: Scans dumps for DEX magic bytes, PEM private key headers, PNG signatures, and key/secret strings using grep, strings, and Python. - Core dump analysis: Replays ELF cores in gdb, eu-stack, and Ghidra for stack traces, registers, and post-mortem analysis. - Use Case: After a packed sample reaches its OEP, dump the process with gcore, then grep the core for 'dex\n035' to carve the decrypted DEX payload for further analysis. ## Quick Start Dump the memory of the running suspicious process and extract any embedded keys or DEX files from the dump.

Frequently Asked Questions about re-memdump

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I dump process memory on Linux?▼

Use gcore -o out <pid> to capture a full ELF core of the running process, or run gdb -p <pid> -ex 'gcore out' from within the debugger. The dump includes memory, registers, and thread state, and can be imported into Ghidra or IDA.

How to extract a DEX file from Android app memory?▼

Dump the process memory first, then scan the core for the DEX magic bytes 'dex\n035' using grep -abo to get byte offsets. Carve the region around each hit to recover the decrypted DEX payload.

Why does reading /proc/pid/mem fail with an error?▼

Direct reads fail because offsets in /proc/pid/mem are virtual addresses, not file offsets, and yama ptrace_scope may block access. Address the target region from /proc/pid/maps, SIGSTOP the process first, and run as root or lower ptrace_scope.

When should I dump memory during unpacking?▼

Dump only after the process reaches its OEP and the packer has finished decrypting; dumping earlier captures the packed initial state. Conversely, once decrypted data appears in memory, save it immediately before it is wiped or overwritten.

Can Volatility analyze a gcore dump?▼

No. gcore produces a single-process ELF core, while Volatility plugins like linux.pslist require a full physical memory image from tools like LiME or DumpIt. For process-level analysis use gdb, eu-stack, or Ghidra instead.

Related Skills

Explore More Software Engineering Skills→
igamenovoerigamenovoer

krnopt-cuda-profiling

Identify CUDA bottlenecks from NSYS traces and NCU reports and attribute them to source regions.

Community
Advanced
xalgordxalgord
954

reverse-engineering-malware-with-ghidra

Reverse engineers malware binaries with Ghidra to analyze C2 protocols, encryption routines, and evasion techniques.

Community
Advanced
philo-grovesphilo-groves
12

maxtac-dast-debugger

Integrate debuggers, instrumentation, and crash replay for binary dynamic analysis.

Community
Advanced
robit-manrobit-man

memory-forensics

Acquire volatile memory with LiME and WinPmem, then analyze it using Volatility 3.

Community
Advanced