memory plugin
Usage : access memory mapped device
TARGETS : all
STATUS : Experimental
You just need to declare a memory slice:
struct memory_config iopram = {
.base = 0,
.size = QueryMemSize(),
.name = "ram",
.desc = "IOP main RAM",
};
Then add it to the memory plugin:
lwnbd_plugin_new(memplg, &iopram);
see full example in examples/local-shell.c
a current limitation of some nbd client is their minimal read is 512 bytes (minimal blocksize) despite the protocol allow 1 byte blocksize. It’s not an issue to dump an entire device, but for now, you need to put a minimal .size of 512 in your structure (and multiple of 512) or you’ll get truncated data. libnbd based software have not this limitation.
PS2 note :
- replacement for ps2client dumpmem/writemem and dump tools
ps2client -h 192.168.0.10 dumpmem host:bios.bin 0xbfc00000 0x400000
eq:
nbdcopy -p nbd://192.168.0.10/bios bios.bin
compare bios md5 sum with http://redump.org/datfile/ps2-bios/
- ImHex-PS2 is a repository for specific ps2 ImHex stuff. It will have useful code to work with this plugin to do live RE/debug session. An ImHex plugin content for nbd would be fine and allow 1 byte blocksize (libnbd) …
documentation :
dump tool analysis to review :
- ImHex
- http://www.wxhexeditor.org/
- https://github.com/allencch/med
- https://infosecwriteups.com/forensics-memory-analysis-with-volatility-6f2b9e859765