1

I'll start by saying, I am not sure if this should go in StackOverflow or ServerFault. I posted it in StackOverflow earlier, but its been getting votes to close the question, so I assume it should be going to ServerFault. Here is the link to SO: https://stackoverflow.com/questions/19125395/windows-app-not-allowing-debugging

Once I get confirmation as to which site this should be on, I'll close the other one.

I am trying to do some analysis on an application I received.

Basically, there is some information obfuscated in the code (an email address). I have the function they used to try to hide the email address, however I am missing one piece of information (the key) which I can't find in the source. I am trying to dump the memory to look through it, but it appears that the memory is protected.

I tried doing a memory dump from task manager but its empty

I tried exploring the memory with sysinternal process explorer, but the process explorer window goes gray and I can't view any memory locations

I tried attaching olly, but I get an ERROR_NOT_SUPPORTED error

I tried using HxD to inspect the memory but I get an error stating that HxD has ran out of memory

Any ideas what I can use to get at this memory?

Community
  • 1
Sugitime
  • 415
  • 1
  • 4
  • 12
  • Why not just run the binary through [`strings`](http://technet.microsoft.com/en-us/sysinternals/bb897439.aspx)? – EEAA Oct 01 '13 at 21:03
  • So I can run the binary and find the string, but I need the value of the string while the application is running. – Sugitime Oct 01 '13 at 21:12

0 Answers0