x
This website is using cookies. We use cookies to ensure that we give you the best experience on our website. More info. That's Fine
HPC:Factor Logo 
 
Latest Forum Activity

Dumping the RAM disk in raw mode in WinCE 3.x-4.x

1 2
chiark Page Icon Posted 2006-12-05 6:47 AM
#
Avatar image of chiark
H/PC Sensei

Posts:
1,330
Location:
North of England
Status:
Can you attach to the kernel process and dump the memory image from there instead? You should get the virtual map of memory rather than the physical map if you try that. Possibly ?
 Top of the page
Hexxx Page Icon Posted 2006-12-05 9:21 AM
#
Avatar image of Hexxx
H/PC Newbie

Posts:
11
Status:
Could you explain me how to do that? As i understand there must be some kernel debugger in Platform Builder.
 Top of the page
chiark Page Icon Posted 2006-12-05 11:59 AM
#
Avatar image of chiark
H/PC Sensei

Posts:
1,330
Location:
North of England
Status:
OpenProcess? ReadProcessMemory call?
Just thinking aloud - no idea if it's possible...

 Top of the page
cmonex Page Icon Posted 2006-12-05 2:35 PM
#
Avatar image of cmonex
H/PC Oracle

Posts:
16,175
Location:
Budapest, Hungary
Status:
well, msdn should have information on those calls.. platform builder or even ida can remotely debug wince. don't know about dumping memory image from there, didn't ever check that.
 Top of the page
Hexxx Page Icon Posted 2006-12-06 4:58 AM
#
Avatar image of Hexxx
H/PC Newbie

Posts:
11
Status:
A little more information. It's not the memory pages as i thought. It's some kind of clusters, maybe database records. Here's an example of the file body stored in ram:
ROM:91CFFA9C DCD 0x30000040 ROM:91CFFAA0 DCD 0x30000000 ROM:91CFFAA4 DCD 0x1B0F - this record id ROM:91CFFAA8 DCD 0x1B10 ROM:91CFFAAC DCD 0x1B11 ROM:91CFFAB0 DCD 0x1B12 ROM:91CFFAB4 DCD 0x1B13 ROM:91CFFAB8 DCD 0x1B14 ROM:91CFFABC DCD 0x1B18 ROM:91CFFAC0 DCD 0x1B15 ROM:91CFFAC4 DCD 0x1B16 ROM:91CFFAC8 DCD 0x1B17 ROM:91CFFACC DCD 0

I see such kind of record before each file body. i.e. 0x1B0F - 0x1B17 are the id of the clusters/records which hold the body.

Then goes the first record/cluster:
ROM:91CFFAE8 DCD 0x60000AB4 ROM:91CFFAEC DCD 0x30000000 ROM:91CFFAF0 DCD 0x1B10 - this record id ROM:91CFFAF4 DCD 0x10003001 ROM:91CFFAF8 DCD 0x2A700 ROM:91CFFAFC DCD 0xB00004F0 ROM:91CFFB00 edm_exe DCW 7 ROM:91CFFB02 DCB 0xAF, 0xA, 0 ; field_0 ROM:91CFFB05 DCB 0xAF, 0xA, 0 ; field_0 ROM:91CFFB08 DCB 0 ROM:91CFFB09 DCB 0x4D ; M ROM:91CFFB0A DCB 0x5A ; Z ROM:91CFFB0B DCB 0x90 ; Ð


Here you can see a start of XIP compressed edm.exe
Then, after record/cluster with id 0x1B10 follows 0x1b11 and so on to 0x1B17.

At first time I've decompressed only 0x400 bytes because, after 0x400 bytes there was a header of another cluster/record. And CeDecompress stopped.

Edited by Hexxx 2006-12-06 4:59 AM
 Top of the page
chiark Page Icon Posted 2006-12-06 6:12 AM
#
Avatar image of chiark
H/PC Sensei

Posts:
1,330
Location:
North of England
Status:
Looks like you're getting somewhere with this... Keep going!
 Top of the page
Hexxx Page Icon Posted 2006-12-07 5:09 AM
#
Avatar image of Hexxx
H/PC Newbie

Posts:
11
Status:
Quote
chiark - 2006-12-05 1:12 PM

Looks like you're getting somewhere with this... Keep going!


This is very helpful...
 Top of the page
Derek.HPCManiac
Derek.HPCManiac Page Icon Posted 2006-12-09 5:48 AM
#
Status:
Hexxx, how I can access my RAM disk in raw mode? Any application to do this? If you guide me, giving programs, I can help you in the process of the ram dump

My processor? MIPS VR4121.

Thanks
 Top of the page
Hexxx Page Icon Posted 2006-12-11 4:53 AM
#
Avatar image of Hexxx
H/PC Newbie

Posts:
11
Status:
You can dump it via VirtualCopy. The file system can be found from fslog_t struture.
I don't need any help anymore. I've already found out how to parse it. Thanks to everyone who helped.

P.S. If anyone is interested in the information about files in RAM: my icq 157363553

Edited by Hexxx 2006-12-11 4:54 AM
 Top of the page
cmonex Page Icon Posted 2006-12-11 1:26 PM
#
Avatar image of cmonex
H/PC Oracle

Posts:
16,175
Location:
Budapest, Hungary
Status:
Hexxx: congrats! i'm interested, so added you to my icq contact list
 Top of the page
chiark Page Icon Posted 2006-12-11 4:22 PM
#
Avatar image of chiark
H/PC Sensei

Posts:
1,330
Location:
North of England
Status:
Would you be interested in writing it up? It'd be really useful to add this to the pool of knowledge on the web somewhere....
 Top of the page
1 2
Jump to forum:
Seconds to generate: 0.218 - Cached queries : 48 - Executed queries : 29