Windows – Find a string in the whole RAM

memorywindows

How to search a string in the whole RAM? (not only in some processes' allocated memory, but the whole RAM)

Or is there a way to dump the whole RAM into a 4GB or 8GB disk file? Then I could easily do:

grep mypassword c:\ramdump.raw

Usage example: I'd like to know if a password manager stores my master password in plaintext, as found by a security team here.

I'm using Windows 7 x64, as administrator.


Note: Unlike How to get complete memory dump in Windows 10? I specifically want to search content in the RAM, and not get information from a memory dump. Moreover this question is unclear: the title doesn't match the content ("Question in title doesn't seem to match the question in the body.")

Best Answer

How to I find a string anywhere in RAM?

You can use windbg (Download Debugging Tools for Windows - WinDbg - Windows drivers | Microsoft Docs) for this.

Example:

To search for a string (Error: 1002) in memory, we run the following command:

0:000> s -a 0 L?80000000 "Error: 1002"
04b0e06c  45 72 72 6f 72 3a 20 31-30 30 32 00 00 00 00 00  Error: 1002.....

...

enter image description here

Source WinDbg: search for a string – Distributed Services: Notes from the field


Further Reading

Related Question