Created
November 21, 2019 09:39
-
-
Save kost/606145346d47c5ed0469d4e9ac415927 to your computer and use it in GitHub Desktop.
Convert VirtualBox ELF memory dump to RAW memory dump
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/bin/bash | |
# Script to convert from vbox elf format to raw (modified from andreafortun -kost) | |
# Memory dump of VirtualBox in Elf format: | |
# vboxmanage debugvm "win7test" dumpvmcore --filename testvbox.elf | |
# Usage: vboxelf2raw.sh testvbox.elf | |
if [ "$1x" == "x" ]; then | |
echo "Usage: vboxelf2raw.sh <file.elf> [out.raw]" | |
echo "Example: vboxelf2raw.sh testvbox.elf" | |
echo "vboxelf2raw.sh will output to testvbox.elf.raw if output is not specified" | |
exit 0 | |
fi | |
inputfile=$1 | |
if [ "$2x" == "x" ]; then | |
outputfile=$1.raw | |
else | |
outputfile=$2 | |
fi | |
size=0x$(objdump -h $inputfile |egrep -w load1 | awk '{print $3}') | |
off=0x$(echo "obase=16;ibase=16;`objdump -h $inputfile |egrep -w load1 | awk '{print $6}'| tr /a-z/ /A-Z/`" | bc) | |
echo "$inputfile -> $outputfile (off: $off, size: $size)" | |
head -c $(($size+$off)) $inputfile |tail -c +$(($off+1)) > $outputfile |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
what about something like this?
As there are multiple sections in the elf file, this is more complete. It's not good code, it's not fast, but it's more complete. Hope it helps someone!