CODEWITHSUNDEEP
firefoxcachingmemory
ychaouche
ychaouche

Reputation: 5092

How can one get an mp3 file cached in firefox's memory?

OS : Linux.

So suppose I just streamed an mp3 file, the file is there in firefox's memory (I can see it in about:cache?device=memory).

I tried a memory dump of the whole browser and searching (with hexedit) a string that is present in the mp3 file. Firefox has a nice about:cache?device=memory page that lists all files that are put in memory cache, I selected the mp3 in question and firefox displays a nice hexdump of it. So I've picked up a string from that dump and searched for it in the core. I could find it, but unfortunately the bytes the follow it are not the same as those that are shown in the about:cache hexdump page, it all seems like the file is scattered.

How could I locate the file in memory and write it to disk ? thanks for any tips.

EDIT

A network-level solution is possible using wireshark

Upvotes: 3

Views: 2647

Answers (1)

ychaouche
ychaouche

Reputation: 5092

For @Anwar :

Download the whole html page of that particular memory-cache entry, then run this function on it (groovy) :

function groovy {
    sed -n '/<pre>/,/<\/pre>/p' "$1" |  replace '<pre>' '' '</pre>' '' | hex2mp3 - "$2"
}

function hex2mp3 {
    echo "in $1"
    echo "out $2"
    echo "cut -c10-74 $1 | xxd -r -p - $2"
    cut -c10-74 "$1" | xxd -r -p - "$2"    
}

Groovy will extract the hexdump from the <pre> </pre> tags, and hex2mp3 will reverse the hexdump to its original binary form so that it in the end you get your mp3 back ;)

cut will discard extra columns from the hexdump and xxd will do the actual reversing operation.

Upvotes: 1

Related Questions