Original writeup (https://0x90r00t.com/2016/02/07/sharif-university-ctf-2016-forensic-400-memdump-write-up/).