Bad Memories -v0.9- -recreation- May 2026

gdb -c core.dump ./bad_memories_v0.9 (gdb) info registers (gdb) x/20gx $rsp Look for a struct:

eu-unstrip -n --core=core.dump This reveals the missing binary path and build ID. We can fetch or reconstruct. After recovering the binary (named bad_memories_v0.9 ), analyze it: Bad Memories -v0.9- -recreation-

gdb -c core.dump (gdb) dump memory recovered.bin 0x400000 0x401000 # typical .text section But better: use volatility (if full memory dump) or memdump from /proc/pid/maps style. gdb -c core

Also found references to malloc , free , heap , and flag.txt . Since only the core dump was given (no original binary), we need to recreate the binary or at least its memory layout. call the overwritten function: However

In GDB, call the overwritten function:

However, this core dump is process-only. Use elfutils :