Omnidump provides detailed insight into processes, returning process metadata to the user. This data includes:

• Memory Region/Address Range: Start and end virtual addresses.
• Permissions: Access rights to the region (read, write, private, or execute).
• Inode: ID of the mapped file that contains core file system metadata.
• Path Name: The file or resources backing the region.
• Offsets: Starting offset within the backing file.
• Major:Minor ID: Device where the backing file is stored.
• Raw bytes: Raw bytes extracted from the memory region.
• Strings from raw bytes: Strings extracted from the raw bytes of a memory region.

The tool empowers analysts, developers, and engineers to extract concrete evidence of application performance and indicators of compromise (IOC).

The steps below provide instructions for installing the latest stable version of Omnidump (v0.1) via pip

Before proceeding, ensure your system meets the following requirements:

1. Python: Version 3.8 or newer must be installed
2. Pip: Ensure your Python package is up to date
3. Permissions: You may be required to have root/admin privileges.

It is strongly recommended to use a virtual environment to avoid conflicts with system packages.

0. Create Virtual Environment

   python3 -m venv omnidump-env

   source omnidump-env/bin/activate

1. Install the Package

pip install omnidump

2. Verify the Installation

   omnidump --help 

If the installation was successful, this command will display the list of available Omnidump commands and options.

The commands below provide examples of how to use Omnidump.

Note: The --self command uses the current PID of the executing command. This command allows new users to test new or existing features before trying them out on their intended application.

0. Basic dump of every memory section

   omnidump dump pid --self --all

0.1. Basic dump of every memory section verbosely (shows inode, permissions, and strings of length 4).

omnidump dump pid --self --all --verbose 

0.2. Basic dump of executable section, including strings (of length 4).

omnidump dump pid --self -e --strings 

1. Log dump of extracted strings from the executable section

   omnidump dump pid --self -e --log-strings --save-dir ./omnidump_strings

1.1 Log dump of extracted strings from both executable and device mappings sections.

omnidump dump pid --self -e -dm --log-strings --save-dir ./omnidump_strings

2. Log dump of raw bytes from executable section.

   omnidump dump pid --self -e --log-sections --save-dir ./omnidump_sections

2.1 Log dump of raw bytes from shared library and heap sections.

omnidump dump pid --self -sl -h --log-sections --save-dir ./omnidump_sections

Omnidump is open to community contributions. Any contributions are greatly appreciated. Please follow the instructions to properly integrate your ideas/changes.

1. Fork the Project
2. Create your feature branch (git checkout -b feature/cool-feature)
3. Commit your changes (git commit -m 'Adding a cool feature')
4. Push to the branch (git push origin feature/cool-feature)
5. Open a pull request