Jump to content

Welcome to MSFN Forum
Register now to gain access to all of our features. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more. This message will be removed once you have signed in.
Login to Account Create an Account


Looking for a way to "sniff" the memory ram and the Cach

- - - - -

  • Please log in to reply
2 replies to this topic




  • Member
  • Pip
  • 89 posts
  • Joined 16-February 10
  • OS:none specified
Hi All,

I am looking for a way to "sniff" and save the memory ram and the Cache from MAC OS into a flash drive.

The reason is that:
I have created video files and encrypted them with AES algorithm (the same password for all of them). The files don't require a password for running them but if you try to run them without specific video player you will have an error message that the files are corrupted.
I have build a video player which first decrypts the video files (with a saved in it password) and then run the selected video.
Without the video player the video files are useless (because the encryption).
The video files are saved on the mac computer and the video player is located on a disk flash so every time that I want to watch the videos I plug the disk flash to the mac, run (double click) the video player and immediately remove the disk flash from the mac itself without coping the player to the mac (the video player is still running and decrypt and play every selected file that I select).
The video files remain encrypted by trying to have access to them outside the video player (the video player just reading them and not modify the original video files).
I want to test the encryption by somehow sniffing to the temporary location which the video player is running and "sniffing" the video player or the decrypted video files from myself.
Any idea how to sniff that temporary location and "steal" the video player or the decrypt video files?

Many Thanks for any advice or direction how to act.

How to remove advertisement from MSFN



    Cyber Ops

  • Super Moderator
  • 3,568 posts
  • Joined 24-September 05
  • OS:none specified
  • Country: Country Flag


I saw some guys freeze the RAM sticks and offload the data.



    Not really Newbie

  • Member
  • PipPipPipPipPipPipPip
  • 1,804 posts
  • Joined 13-January 06
You need to attach a debugger to the running process (the player) and for the further directions read how to disassemble and debug your own code.

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users