Using a software exploit to image RAM on an embedded system

The research in this paper is the result of a court case involving copyright infringement, specifically, a request for expert evidence regarding the proportion of copyrighted data present in the RAM of a games console. This paper presents a novel method to image the memory of an embedded device (a games console) where normal software and hardware memory imaging techniques are not possible. The paper describes how a buffer overflow exploit can be used in order to execute custom code written to create an image of the console's memory. While this work is concerned with the Microsoft Xbox, the principles of vulnerability enabled data acquisition could be extended to other embedded devices, including other consoles, smart phones and PDAs.