[CrazyDoctor]

Hi All,

I am looking for a way to "sniff" and save the memory ram and the Cache from MAC OS into a flash drive.

The reason is that:
I have created video files and encrypted them with AES algorithm (the same password for all of them). The files don't require a password for running them but if you try to run them without specific video player you will have an error message that the files are corrupted.
I have build a video player which first decrypts the video files (with a saved in it password) and then run the selected video.
Without the video player the video files are useless (because the encryption).
The video files are saved on the mac computer and the video player is located on a disk flash so every time that I want to watch the videos I plug the disk flash to the mac, run (double click) the video player and immediately remove the disk flash from the mac itself without coping the player to the mac (the video player is still running and decrypt and play every selected file that I select).
The video files remain encrypted by trying to have access to them outside the video player (the video player just reading them and not modify the original video files).
I want to test the encryption by somehow sniffing to the temporary location which the video player is running and "sniffing" the video player or the decrypted video files from myself.
Any idea how to sniff that temporary location and "steal" the video player or the decrypt video files?

Many Thanks for any advice or direction how to act.
Regards,

[tain]

I saw some guys freeze the RAM sticks and offload the data.

[allen2]

You need to attach a debugger to the running process (the player) and for the further directions read how to disassemble and debug your own code.