I am researching some malware which loads multiple Sqlite Databases into memory during its operation. I've managed to dump the memory to disk in a large block however I cannot view the databases currently as I can't figure out how large the file should be.The headers appear intact however I can't easily figure out where the end of the database is. Can someone help me figure out what the byte size of the entire DB should be form this header? Or can someone suggest some software that is not picky on the format of the DB, eg if I include garbage at the end of the file it will automatically figure out where to stop.Format explained here:https://www.sqlite.org/fileformat.htmlHeader = SQLite format 300 00 53 51 4c 69 74 65 20 66 6f 72 6d 61 74 20 33 00 Page size = 102404 00 Format write version01Format read version01 Bytes unreserved space00 Maximum embedded payload fraction (must be 64)40 Maximum embedded payload fraction (must be 32)20 Leaf payload fraction (must be 32)20 File Change counter00 00 01 5fSize of the database file in pages (16)00 00 00 10 Page number of the first freelist trunk page00 00 00 09 Total number of freelist pages.00 00 00 01 The schema cookie00 00 00 03 The schema format number. Supported schema formats are 1, 2, 3, and 4.00 00 00 04 Default page cache size.00 00 00 00 The page number of the largest root b-tree page when in auto-vacuum or incremental-vacuum modes, or zero otherwise.00 00 00 00 The database text encoding. A value of 1 means UTF-8. A value of 2 means UTF-16le. A value of 3 means UTF-16be.00 00 00 01 The user version as read and set by the user_version pragma.00 00 00 0FTrue (non-zero) for incremental-vacuum mode. False (zero) otherwise.00 00 00 00 00 The Application ID set by PRAGMA application_id.00 00 00 00 Reserved for expansion. Must be zero. 00 00 00 00 00 00 00 0000 00 00 00 00 00 00 00 00 00 00 00 The version-valid-for number.00 00 00 01SQLITE_VERSION_NUMBER00 2D F1 B8edit: Appears the problem may be in the database table format. Here is an example of one of the tables.Format of Dumped DB. Table def starts at offset 229tableCommTypeCommType   CREATE TABLE CommType(    CommID INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL,    CommName TEXT NOT NULL)If I recreate the DB myself I get the following format. Why is this different?Starts at offset 784 (lots of padding before)tablesqlite_sequencesqlite_sequenceCREATE TABLE sqlite_sequence(name,seq)utableCommTypeCommTypeCREATE TABLE `CommType` (    `CommID` INTEGER NOT NULL PRIMARY KEY AUTOINCREMENT,    `CommName` TEXT NOT NULL)edit2: It appears I've dumped RAM that was used by the in memory database creation. I have lots and lots of the same CREATE TABLE strings in a sequence repeating with small changes. Most likely due to the code doing sql = sql + moreSql or something like that and I've just dumped these strings opposed to an entire in memory database. I need to do a bigger memory dump to find the actual DB
Dumping SQLITE database out of memory and viewing without original DB
memory;memory dump