Exetools

Exetools (https://forum.exetools.com/index.php)
-   Community Tools (https://forum.exetools.com/forumdisplay.php?f=47)
-   -   NativeDumper (https://forum.exetools.com/showthread.php?t=17690)

CodeCracker 06-22-2016 19:59

NativeDumper
 
2 Attachment(s)
NativeDumper:
Native module dumper, just select a process
do right mouse click and choose "Dump main module"
or "Modules" to enumerate modules, select target module,
do right mouse click an choose "Dump".

Advantage over other dumpers:
- Small dump file size ( with default dumping options
more exactly with "Fix Raw" option unchecked (off).

NativeDumper .zip (binary)
and
NativeDumper(Src).zip (source code Visual C++) attached.

FoxB 06-22-2016 22:22

also we can use

------------------------------
Process Dump v1.4
Copyright й 2015, Geoff McDonald
http://www.split-code.com/

Process Dump (pd.exe) is a tool used to dump both 32 and 64 bit executable modules back to disk from memory within a process address space. This tool is able to find and dump hidden modules, and it uses a clean hash database to exclude dumping of known clean files. This tool uses an aggressive import reconstruction approach that links all DWORD/QWORDs that point to an export in the process to the corresponding export function.
------------------------------

TechLord 06-24-2016 09:19

Quote:

Originally Posted by FoxB (Post 105836)
also we can use

------------------------------
Process Dump v1.4
Copyright й 2015, Geoff McDonald
http://www.split-code.com/

...

Now actually v1.5 is available... :)

Direct download link of compiled v1.5 :

http://split-code.com/files/pd_latest.zip

CodeCracker 03-08-2017 18:14

1 Attachment(s)
New options:
"Round raw size" - Not actually necessary, will round raw size of sections to FileAlignment
"Current EIP" to change the EntryPoint - you should stop at old entry point with Olly or other debugger,

"Sections info from" Memory or File.

Raw options:
"Original raw" - don't make any change to raws (raw address and raw size) of sections, note that this will fail for 99% of packers/protectors
Good for application virtualizators like Spoon Studio to get original untoched module from memory.
"RAW=VA" - set RAW address = Virtual Address and RAW Size = Virtual size of section, using this option you will have working dumps but a bit larger dumps.
"Calculate raw" - preferable option, will try to recalculate raw addresses and raw sizes.

serseri_1453 04-24-2018 03:34

Quote:

Originally Posted by CodeCracker (Post 108695)
New options:
"Round raw size" - Not actually necessary, will round raw size of sections to FileAlignment
"Current EIP" to change the EntryPoint - you should stop at old entry point with Olly or other debugger,

"Sections info from" Memory or File.

Raw options:
"Original raw" - don't make any change to raws (raw address and raw size) of sections, note that this will fail for 99% of packers/protectors
Good for application virtualizators like Spoon Studio to get original untoched module from memory.
"RAW=VA" - set RAW address = Virtual Address and RAW Size = Virtual size of section, using this option you will have working dumps but a bit larger dumps.
"Calculate raw" - preferable option, will try to recalculate raw addresses and raw sizes.


alternativ download link please

Mahmoudnia 04-24-2018 03:44

Quote:

Originally Posted by serseri_1453 (Post 113125)
alternativ download link please

Code:

http://rgho.st/82XKmrkQK


All times are GMT +8. The time now is 19:09.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2024, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX