Possible to "manually" search a running program's memory?

C

Coldblackice

[H]ard|Gawd
Joined
Aug 14, 2010
Messages
1,152
Would it be possible to manually search through a running/active program's memory (in Windows 7)?

Windows just notified me that Firefox "has stopped working" and is asking me to close or debug. I had a number of tabs and important posts I was working on that I'm now about to lose.

Because Firefox's window is now grayed out (with the Close vs Debug option box), I'm wondering if I could manually search through its still-active memory to get the titles/URLs of tabs I had open, possibly even text I was posting. Firefox.exe is still running -- I have yet to click "Close program" or "Debug".

Is there any third-party utility that could accomplish this? Or, might this be doable via the "Debug" option?
 
If the process is still running you could try to attach a debugger to it and poke around. Cheatengine would probably have the shortest learning curve of free debuggers that I know of. OllyDbg is shareware, but I don't know of any restrictions it places on you. Visual Studio has a debugger, but I have never used it.
 
http://technet.microsoft.com/en-gb/sysinternals/dd996900.aspx

SysInternals ProcDump can dump out the memory used by a running process or application to a file. Warning: the dump file will probably be gigantic.

Run it with the -ma parameter to do a full dump. For example, from the command line type: procdump -ma firefox

Who knows what data structures FireFox uses in memory to store tabs, and where information for those tabs are stored. I don't doubt you could extract text you typed or url names, but it's probably going to be slow to search the dump file.
 
Sgraffite said:
If the process is still running you could try to attach a debugger to it and poke around. Cheatengine would probably have the shortest learning curve of free debuggers that I know of. OllyDbg is shareware, but I don't know of any restrictions it places on you. Visual Studio has a debugger, but I have never used it.
Click to expand...

pxc said:
http://technet.microsoft.com/en-gb/sysinternals/dd996900.aspx

SysInternals ProcDump can dump out the memory used by a running process or application to a file. Warning: the dump file will probably be gigantic.

Run it with the -ma parameter to do a full dump. For example, from the command line type: procdump -ma firefox

Who knows what data structures FireFox uses in memory to store tabs, and where information for those tabs are stored. I don't doubt you could extract text you typed or url names, but it's probably going to be slow to search the dump file.
Click to expand...

MysticRyuujin said:
There are memory editors for cheating games as Sgraffite suggested:
http://www.cheatengine.org/
Click to expand...

Thanks all for the suggestions. Using CheatEngine works great (I also made a full dump using ProcDump, too).

Searching through the memory, I've found tabs/URLs that I was on when the crash happened. However, like pxc mentioned, there doesn't seem to be any rhyme or reason where they're located.

Is there anywhere I could find the pattern/data structures where active tab URLs are stored? I realize I may just have to call this a loss and move on.
 
Can't you just go to History > Restore Previous Session after you restart firefox?

Chances are firefox will reload your tabs automatically anyway, text entries might be lost though.
 
Coldblackice said:
Searching through the memory, I've found tabs/URLs that I was on when the crash happened. However, like pxc mentioned, there doesn't seem to be any rhyme or reason where they're located.
Click to expand...

You're probably looking at heap-allocated memory, in which case it would naturally be fairly randomly located.
 
There is one other way to restore tabs and session.

For Firefox, go to this directory:
Code: 
C:\Users\{USER NAME}\AppData\Roaming\Mozilla\Firefox\Profiles\{RANDOM LETTERS}.default

Make a backup of these two files in another location:
Code: 
sessionstore.bak

sessionstore.js

Now, before continuing, be sure that Firefox is fully closed so check Task Manager first.

Delete "sessionstore.js" and rename "sessionstore.bak" to the previous file you deleted.
(e.g.- sessionstore.js)

To save Firefox sessions, I recommend this add-on: Session Manager.
https://addons.mozilla.org/en-US/firefox/addon/session-manager/

(In Chrome, I recommend Session Buddy.)

With Session Manager, you can also have an auto-saving session profile, and you can restore a previous session if Firefox crashes.

As for form data, unfortunately you need to find some way to read the memory or variable data, or something. There is an easier way: a couple of add-ons for Firefox works.

Form History Control:
https://addons.mozilla.org/en-US/firefox/addon/form-history-control/

Lazarus Form Recovery:
https://addons.mozilla.org/en-US/firefox/addon/lazarus-form-recovery/

Form Saver MOD:
https://addons.mozilla.org/en-US/firefox/addon/form-saver-mod/
 
Thanks for the suggestions. I already use (and love) Session Manager + Lazarus. Easily two of my favorite extensions. However, one "inconvenient" point I didn't mention was that, although I had multiple browser windows open and knew I'd be able to restore those just fine, it was the one "Private Browsing" window open that I was stressing about.

Yeah, yeah, yeah... -- what ever was I doing in a Private Browsing window? :) -- I opened it to log into a second Gmail account (concurrently) with my main email, bypassing a same-browser cookie clashing. And then as goes in the life of a tab-junkie, I soon forgot it was a private and just kept working inside it concurrently.

Literally 20 minutes before it crashed, I even had the thought "Ah, better transfer these tabs out in case this crashes..." And whaddya know -- prophecy, lol.

Anyway, I ended up doing a full dump just in case, and then half looking through my router's IP log + half shrugging it off and moving on. Lesson learned. Thanks for the help and suggestions.
 
Coldblackice said:
Thanks for the suggestions. I already use (and love) Session Manager + Lazarus. Easily two of my favorite extensions. However, one "inconvenient" point I didn't mention was that, although I had multiple browser windows open and knew I'd be able to restore those just fine, it was the one "Private Browsing" window open that I was stressing about.

Yeah, yeah, yeah... -- what ever was I doing in a Private Browsing window? :) -- I opened it to log into a second Gmail account (concurrently) with my main email, bypassing a same-browser cookie clashing. And then as goes in the life of a tab-junkie, I soon forgot it was a private and just kept working inside it concurrently.

Literally 20 minutes before it crashed, I even had the thought "Ah, better transfer these tabs out in case this crashes..." And whaddya know -- prophecy, lol.

Anyway, I ended up doing a full dump just in case, and then half looking through my router's IP log + half shrugging it off and moving on. Lesson learned. Thanks for the help and suggestions.
Click to expand...
Ah, you were in Private Browsing mode.

I remember making a similar mistake and the browser crashing on me. Luckily for Chrome, you can enable an extension to work in Incognito Mode, so that helps a lot there. I don't see a similar option for Firefox extensions, unfortunately.
 
You must log in or register to reply here.
Back
Top