Dumping Memory to Raw File

Question

Is there a way to dump a section of process memory knowing the start and end address to raw bin file via a winapi function or some other method? I know that you can do this easily with a debugger, but that's not what I'm looking for.

Answer 1

I have recently made an API in python to read and write memory - could be useful for a quick solution. https://github.com/samsonpianofingers/pymem

you could use this like this

import pymem

handle = pymem.open_process_name("program.exe")
address = 0x12c0000
size = 1000
buffer = pymem.read_bytes(handle, address, size)
with open("dump.bin", "wb") as f:
    f.write(buffer)
    f.flush()
    f.close()

Answer 2

you can craft a powershell script in case of emergency (no python no internet only base machine cant install anything whatever )

the code below is rubbish hack you may need to declare proper managed types etc to make it robust it is just to show an idea

$procid = (Get-Process -Name $args[0]).Id
$baseaddr = (Get-Process -Name $args[0] -Module)[0].BaseAddress;
$signature = @"
[DllImport("kernel32.dll")] public static extern IntPtr OpenProcess(
    uint h,bool b ,uint p);
[DllImport("kernel32.dll")] public static extern bool ReadProcessMemory(
    IntPtr hp,IntPtr Base,[Out]Byte[] buff,int Size,[Out]int bread);
"@
$rpm = Add-Type -MemberDefinition $signature -Name rpm -PassThru
[Byte[]] $buff = New-Object Byte[](256)
[int]$bread =0;
$proc = $rpm::OpenProcess(0x001F0FFF,0,$procid);
$read = $rpm::ReadProcessMemory($proc,$baseaddr,$buff,256,$bread);
$a = "";
$a+=[char[]]$buff[0..1]+[char[]]$buff[78..118]
$procid
"{0:X}" -f [int]$baseaddr
$a

running it like

powershell -f foo.ps1 note*
3388
8D0000
M Z T h i s   p r o g r a m   c a n n o t   b e   r u n   i n   D O S   m o d e .

powershell -f foo.ps1 exp*
304
C40000
M Z T h i s   p r o g r a m   c a n n o t   b e   r u n   i n   D O S   m o d e .