Save injected code

Question

I am analyzing a binary that is injecting code into another process (i.e., svchost.exe) to make the debugging more tedious. I can attach the new process to a debugger (e.g., ollydbg or the one featured by IDA Pro) and read the assembly code. However, I was wondering whether it is possible or not to take like a snapshot of this so I can later on analyze the code offline (as any other binary).

Thanks!

Answer 1

So your definition of a "snapshot" is somewhat vague. Hopefully my answer matches your idea:

Did you already take a look at the OllyDumpEx Plugin?

This plugin is process memory dumper for OllyDbg and Immunity Debugger. Very simple overview: OllyDumpEx = OllyDump + PE Dumper - obsoleted + useful features

Of course you can simply dump the raw memory as described here with ollydbg itself.