The Nixu Challenge - 2019 - Bad memories - part 1
-------------------------------------------------

This time we're looking at a memdump and by the looks of the assignment we're looking for text.

First step was to determine what OS the dump was from, though most likely it's some x64 Windows. So decided to go with Volatility:

	volatility --info mem.dmp

Which tells it's Windows, so let's go with Win7SP1x64.

Started by checking what was running when the dump was made:

	volatility cmdlines -f mem.dmp --profile=Win7SP1x64 > cmdlines

The cmdlines show that there was notepad.exe PID: 700 running.
Let's inspect that first:

        volatility memdump -f mem.dmp --profile=Win7SP1x64 -p 700 -D .

Then just quickly check strings from the 700.dmp that results from the previous. Remember that Notepad stores data as little endian, so "-e l" is needed:

        strings -e l 700.dmp > 700.str

Still over 400k rows, which is way too much. Let's grep:

        cat 700.str | grep {*.*} > 700.flg

Then we browse through the resulting 58k+ lines. Just in the first few rows we can see:

        AVKH{guvf_j4f_gu3_rnfl_bar}

Most likely ROT13 again, let's try decrypting:

        NIXU{this_w4s_th3_easy_one}