ptn1411/skill/memory-dumper

Claude Code and agent skill by ptn1411/skill

Trust tier 2
  • community
LLM review pending
Source check pending

Checking that the SKILL.md file is still in the repository.

Dump process memory and scan for secrets, license keys, decryption keys, tokens, and crypto artifacts. Cross-platform: comsvcs.dll / MiniDumpWriteDump on Windows, /proc/mem on Linux.

Install

npx vskill@latest install ptn1411/skill/memory-dumper

SKILL.md

Memory Dumper

Dump running process memory and scan for embedded secrets — license keys, API tokens, crypto keys, decrypted strings that never touch disk.
Language rule: All skill instructions use English.
Final summary presented to the user must be in Vietnamese.

0. Authorization & Routing

Operates under MASTER_POLICY.md §1-§2.

Sibling skillWhen
frida-hookerHook crypto functions to capture keys at call time
network-interceptorCross-reference memory tokens with network traffic
electron-app-analyzerFind JS strings that match memory artifacts
nuitka-decryptorCompare decrypted Nuitka blobs with memory dumps

Step 1 — Dump Process Memory

Windows (comsvcs.dll — no extra tools needed)
powershell
python scripts\dump_process.py --pid 1234 --out dumps\target.dmp
python scripts\dump_process.py --name "TargetApp.exe" --out dumps\target.dmp
Windows (ProcDump — Sysinternals)
powershell
python scripts\dump_process.py --pid 1234 --method procdump --out dumps\target.dmp
Linux (/proc/mem)
bash
python scripts/dump_process.py --pid 1234 --out dumps/target.dmp
python scripts/dump_process.py --name "target_app" --out dumps/target.dmp

Requires: elevated privileges (Administrator / root) for full memory access.

Step 2 — Scan Memory Dump

bash
python scripts/scan_memory.py dumps/target.dmp --out analysis/
powershell
python scripts\scan_memory.py dumps\target.dmp --out analysis\

Detects:

  • License keys: Common serial formats (XXXXX-XXXXX-...), base64 license blobs
  • API tokens: Bearer tokens, JWT, API keys, OAuth tokens
  • Crypto keys: AES/RSA key material, high-entropy blocks adjacent to crypto constants
  • URLs: HTTP(S) endpoints, license server URLs
  • Strings: UTF-8 and UTF-16 printable strings with context

Options:

  • --min-entropy 4.5 — Minimum Shannon entropy for key candidate blocks
  • --key-size 16,32 — Expected key sizes in bytes (AES-128, AES-256)
  • --cross-ref strings.txt — Cross-reference with known strings from static analysis

Step 3 — Cross-Reference with Static Analysis

Feed scan results back to other skills:

bash
# Compare memory strings with Nuitka .rsrc constants
python scripts/scan_memory.py dumps/target.dmp --cross-ref nuitka_strings.txt --out xref/
 
# Compare with electron ASAR strings
python scripts/scan_memory.py dumps/target.dmp --cross-ref asar_strings.txt --out xref/

Final Report (Vietnamese)

🧠 Phân tích memory dump hoàn tất:
 
  📦 Dump size        : <SIZE> MB
  🔤 Strings found    : <COUNT> (UTF-8: X, UTF-16: Y)
  🔑 License keys     : <COUNT>
  🎫 API tokens       : <COUNT>
  🔐 Crypto key cands : <COUNT>
  🌐 URLs found       : <COUNT>
  📊 Cross-ref matches: <COUNT>
 
  💾 Output: analysis/

Anti-Patterns

❌ Don't✅ Do
Dump without elevated privilegesRun as Administrator / root
Scan only UTF-8 stringsAlways scan both UTF-8 and UTF-16LE
Ignore high-entropy blocksEntropy analysis catches AES keys
Dump after app exitsDump while app is running with license active
Skip cross-referencingCompare memory strings with static analysis output
Use only one dump methodTry comsvcs.dll first, fallback to ProcDump or API

Security

  • Security scanPassed, 100 of 100Pattern checks on the skill's files.
  • Model reviewNot runA model review is scheduled for the next rescan.

See the full security report

Quality evaluation

  • Task evaluationNot runNo evaluation yet. Run one in Skill Studio.

See evaluation results

Source

Popularity

Repository stars
150
Repository forks
90
7-day trend score
25

Stars and forks are for the whole GitHub repository, not this skill alone. Not refreshed yet.

Works with

Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.

  • Claude Code
  • Cursor
  • GitHub Copilot
  • Windsurf
  • Codex
  • Gemini CLI
  • Cline
  • Amp
  • Roo Code
  • Goose
  • Continue
  • Kilo Code
  • Junie
  • Trae
  • OpenHands
  • Qwen Code
  • AI Agent
  • Tabnine Chat
  • Sourcegraph Cody
  • Amazon Q
  • Firebase Genkit
  • Sweep
  • Devin
  • Phind
  • Mentat
  • Claude Desktop
  • Aider
  • GPT Pilot
  • Plandex
  • bolt.new
  • v0
  • Replit Agent
  • Anse
  • TypingMind
  • BetterChatGPT
  • LibreChat
  • Warp AI
  • Pieces
  • Fig AI
Embed badge
vskill VERIFIED badge
[![vskill VERIFIED](https://verified-skill.com/api/v1/skills/ptn1411/skill/memory-dumper/badge)](https://verified-skill.com/skills/ptn1411/skill/memory-dumper)

Something wrong with this skill or its page? Tell us.