turdshovel: dump objects from .NET memory dumps
turdshovel
Turdshovel is an interactive CLI tool that allows users to dump objects from .NET memory dumps without having to fully understand the intricacies of WinDbg. It uses Python.NET to wrap around ClrMD and perform basic operations for dumping objects and sections of memory. The primary goal of Turdshovel is to focus on finding secrets in memory dumps quickly.
It is absolutely not intended to be a full-fledged memory dump analysis tool.
Use
Turdshovel uses Nubia as its framework for an interactive CLI.
| Command | Arguments | Description |
|---|---|---|
| load | Loads a dump for a session | |
| dump heap | filter – Filter objects by strings | Lists objects on the heap |
| dump obj | address – Address of object to dump save – Save ouput to disk |
Dumps object on the heap by address |
| dump mem | address – Address of memory to read length – Length of bytes to read |
Dumps the memory in bytes at location |
| help | Show help | |
| exit | Exit |
Command
- load
The load command takes the path to the file dump as an argument.
- dump heap
Similar to the dump heap command via SOS, this command will list the objects on the heap as well as their type. However, the output differs in that Turdshovel does not show objects which are listed as “Free” on the heap. You can optionally pass a list of strings as the filter.
- dump obj
Similar to the dump obj command via SOS, this command will dump all of the non-static fields of the object on the heap in JSON representation. You can also pass save=True to save the resulting JSON to disk.
IMPORTANT: When dumping a complex object, you may notice fields <!>. This indicates that the field would have caused a recursion error to occur so Turdshovel did not parse the field. This usually occurs with objects that reference themselves.
- dump mem
Prints the bytes at the location specified for the amount of bytes specified. This is useful when objects point to locations in memory that are not objects, such as encrypted data, or just seeing what is around any given memory address. The example shows a simple string which you could find with the strings command but there are better use cases, specifically with pointers!
Installation
Copyright (c) 2021 Leron Gray
