Memory dump

We can easily view the contents of a memory location with the memory dump. We can use Immunity Debugger or pwndbg for this.

How to do it...

Follow the steps for better understanding of memory dump:

1. Open an application in the Immunity Debugger.

2. If you want to view the memory dump in ESI register and right-click on the address and select the Follow in Dump option:

3. This will update the memory dump window in the bottom-left corner. The memory dump window in Immunity Debugger looks as follows:

4. With pwndbg we can get the memory dump with the hexdump command. For that, load the application in gdb and run it with a breaker:

pwndbg> break 5
pwndbg> run  

5. Now to view the memory dump in RSI register, run...