Dump Virtual Box Memory

Last updated 7 months ago

A quick reminder of one of the ways of how to dump memory of a VM running on VirtualBox in Linux environment.

Enable Debug Mode
linux host
[email protected]~: virtualbox --startvm 'yourVMName or VM UUID' --dbg
Dump VM Memory
Launch the VirtualBox debug console by navigating to "Debug" menu an select "Command Line":
Once you select "Command Line", you will be presented with a console that looks like this:
memory dump will be a raw file dumped to /home/youruser directory
To create a memory dump, issue the below command (also highlighted in the above graphic):
[email protected]
VBoxDbg> .pgmphystofile 'w7-nc-shell.bin'
Persistence
If you want the debug options to be always available, you can:
export VBOX_GUI_DBG_ENABLED=true before launching the VM or
put export VBOX_GUI_DBG_ENABLED=true in your .bashrc or /etc/environment 

Memory Forensics - Previous

Process Environment Block

Next - CTFs / Walkthroughs

Reversing Password Checking Routine