FYI, I had followed this instruction precisely.
https://www.gabriel.urdhr.fr/2015/01/15/recover-a-password-in-a-process-memory/
>Today, I managed to forget a password but I had a Icedove (Thunderbird)
process running containing the password.
>The first thing to do is to take a core dump of the process:
# I don't want other people to read my core dump:
umask 022
# I don't want my core dump to be written on disk, let's go on a tmpfs:
cd /tmp
gcore -o core $(pgrep icedove)
>The basic idea is to use use strings to extract all the strings in the core
dump and filter out as much entries as possible: you look start strings core
| uniq | less and add filters in the pipeline to remove as many entries as
possible.
>I ended up with something similar to this:
strings core.2169 |
# Remove some useless stuff:
grep -v ZZZ | grep -v /usr | grep -v /lib | grep -v /bin |
# Add constraints on the characters used in the password:
grep [0-9] | grep [a-z] | grep [A-Z] |
# Add constraints on the length of the password:
grep -Ev '.{20}' | grep -E '.{5}' |
# Let's look at what's left:
uniq | less
>There were still, more than 36000 entries but I searched a password that I
remembered and the forgotten password was a few line around the other one.
😄
>Don't forget to remove (or shred) the core file:
rm core
