Listening to Computer Memory

An alternative to converting memory dumps to sound files is to save a memory range to a binary file and then convert it to a wave file. The latter is better for complete memory dumps which can be several Gb in size.

To save a memory range to a file use WinDbg .writemem command:

.writemem d2w-range.bin 00400000 00433000

or

.writemem d2w-range.bin 00400000 L200

I wrote a WinDbg script that saves a specified memory range and then calls a shell script which automatically converts saved binary file to a wave file and then runs whatever sound program is registered for .wav extension. On many systems it is Microsoft Media Player unless you installed any other third-party player.

The WinDbg script code (memsounds.txt):

.writemem d2w-range.bin ${$arg1} ${$arg2}
.if (${/d:$arg5})
{
  .shell -i- memsounds.cmd d2w-range ${$arg3} ${$arg4} ${$arg5}
}
.elsif (${/d:$arg4})
{
  .shell -i- memsounds.cmd d2w-range ${$arg3} ${$arg4}
}
.elsif (${/d:$arg3})
{
  .shell -i- memsounds.cmd d2w-range ${$arg3}
}
.else
{
  .shell -i- memsounds.cmd d2w-range
}

The shell script (memsounds.cmd):

dump2wave %1.bin %1.wav %2 %3 %4
%1.wav

Because WinDbg installation folder is assumed to be the default directory for both scripts and Dump2Wave.exe they should be copied to the same folder where windbg.exe is located. On my system it is

C:\Program Files\Debugging Tools for Windows

Both scripts are included in Dump2Wave package available for free download:

Dump2Wave package

To call the script from WinDbg use the following command:

$$>a< memsounds.txt Range [Freq] [Bits] [Channels]

where Range can be in Address1 Address2 or Address Lxxx format, Freq can be 44100, 22050, 11025 or 8000, Bits can be 8 or 16, Channels can be 1 or 2. By default it is 44100, 16, 2.

If you have a live debugging session or loaded a crash dump you can listen to a memory range immediately. For example, the range of memory from 00400000 to 00433000 interpreted as 44.1KHz 16bit stereo:

0:000> $$>a< memsounds.txt 00400000 00433000
Writing 33001 bytes...

C:\Program Files\Debugging Tools for Windows>dump2wave d2w-range.bin d2w-range.wav

Dump2Wave version 1.2.1
Written by Dmitry Vostokov, 2006

d2w-range.wav
d2w-range.bin
        1 file(s) copied.

C:\Program Files\Debugging Tools for Windows>d2w-range.wav
.shell: Process exited
0:000>

or the same range interpreted as 8KHz 8bit mono:

0:000> $$>a< memsounds.txt 00400000 00433000 8000 8 1
Writing 33001 bytes...

C:\Program Files\Debugging Tools for Windows>dump2wave d2w-range.bin d2w-range.wav 8000 8 1

Dump2Wave version 1.2.1
Written by Dmitry Vostokov, 2006

d2w-range.wav
d2w-range.bin
        1 file(s) copied.

C:\Program Files\Debugging Tools for Windows>d2w-range.wav
.shell: Process exited
0:000>

The script starts Windows Media Player on my system and I only need to push the play button to start listening.

Enjoy :-)

- Dmitry Vostokov @ DumpAnalysis.org -

12 Responses to “Listening to Computer Memory”

  1. Manohara Says:

    Dmitry

    You are simply amazing and one of the most creative person i have ever seen, this artcile just is simpllllllllllllllly amazing :D and totally out of this world.

    Thanks,
    Manohara

  2. Dmitry Vostokov Says:

    Thanks :-)

  3. Manohara Says:

    Dmitry

    Another Idea ,
    dump memory , then make bmp / image and c what it looks look , :D

    Thanks,
    Manohara

  4. Dmitry Vostokov Says:

    Manohara,

    Will try to convert to BMP and let you know :-)

    Dump Tomography:

    http://www.dumpanalysis.org/blog/index.php/2006/10/22/dump-tomography/

    Thanks for reminding me. I was also thinking that images from several consecutive dumps can be used for “video” or even live process changes can be visualized like heap size, etc.

    For user dumps this should be trivial. Complete memory dumps are snapshots of physical memory so I expect much noise there due to random page mapping. I think kernel memory dumps are stored as a virtual address range. If this is the case there is no need to reconstruct virtual address space from physical.

    Thanks,
    Dmitry

  5. Dmitry Vostokov Says:

    As promised here is Dump2Picture v1.0:

    http://www.dumpanalysis.org/blog/index.php/2007/08/04/visualizing-memory-dumps/

  6. ClickF1 Says:

    You are crazy :-) I’m shocked!

  7. Dmitry Vostokov Says:

    Security warning:

    http://www.dumpanalysis.org/blog/index.php/2007/08/15/memory-visualization-and-security/

  8. Dmitry Vostokov Says:

    Source code for Dump2Wave:

    http://www.dumpanalysis.org/blog/index.php/2008/02/08/dump2wave-v121-source-code/

  9. Crash Dump Analysis » Blog Archive » Forthcoming Dumpstatic Album Says:

    […] music for this album will be written with the help of Dump2Wave technology Stay statically tuned to further […]

  10. Erdenebat Chuluun Says:

    Very creative person. Good luck man.

  11. Software Astrology » Blog Archive » Build Date: December 12 Says:

    […] of a module, a product or a system built on December 12 (generated with the help of Dump2Wave) is more important characteristic than what they are saying. In order to grow December 12 […]

  12. Crash Dump Analysis » Blog Archive » Memory Auralization: Computational Opera Says:

    […] is the enhanced version of Dump2Wave technology that allows to transform computational operations into audible artifacts. Threads are […]

Leave a Reply

You must be logged in to post a comment.