47 lines
1.9 KiB
Python
47 lines
1.9 KiB
Python
import struct
|
|
import sys
|
|
|
|
def carve_ramdrive(dump_file):
|
|
with open(dump_file, 'rb') as f:
|
|
data = f.read()
|
|
|
|
print("Searching for FAT Boot Sectors...")
|
|
# FAT filesystem identifiers in the boot sector
|
|
for fs_type in [b'FAT12 ', b'FAT16 ']:
|
|
idx = 0
|
|
while True:
|
|
idx = data.find(fs_type, idx)
|
|
if idx == -1: break
|
|
|
|
# The fs_type string is at offset 0x36 in the boot sector
|
|
boot_start = idx - 0x36
|
|
|
|
# Check for the jump instruction that starts all FAT boot sectors (EB xx 90 or E9 xx xx)
|
|
if boot_start >= 0 and data[boot_start] in [0xEB, 0xE9]:
|
|
try:
|
|
# Parse the exact size of the drive from the boot sector header
|
|
bps = struct.unpack('<H', data[boot_start+11:boot_start+13])[0]
|
|
sectors = struct.unpack('<H', data[boot_start+19:boot_start+21])[0]
|
|
if sectors == 0: # If 0, it uses the 32-bit sector count
|
|
sectors = struct.unpack('<I', data[boot_start+32:boot_start+36])[0]
|
|
|
|
size = bps * sectors
|
|
|
|
if 0 < size < len(data):
|
|
print(f"\n[+] Found {fs_type.decode().strip()} RAM Drive at offset {boot_start}!")
|
|
print(f" Size: {size} bytes ({size/1024/1024:.2f} MB)")
|
|
out_name = f"ramdrive_{boot_start}.img"
|
|
|
|
with open(out_name, 'wb') as out:
|
|
out.write(data[boot_start:boot_start+size])
|
|
print(f" Saved clean image as {out_name}")
|
|
except Exception as e:
|
|
pass
|
|
idx += 1
|
|
|
|
if __name__ == "__main__":
|
|
if len(sys.argv) != 2:
|
|
print("Usage: python3 extract_ramdrive.py <memory_dump.bin>")
|
|
else:
|
|
carve_ramdrive(sys.argv[1])
|