Unpacking and dumping executable from DLL

Question

I'm trying to unpack and dump executable from a DLL packed file, I've loaded the DLL to Immunity Debugger using LOADDLL.exe.

I think I've reached the OEP 0x3DADDD (the memory location of the unpacked code has been allocated with VirtualAlloc), When I'm trying to dump the unpacked code with OllyDumpEx I get the LOADDLL.exe sections and not the unpacked dump file sections (The dumped file is LOADDLL.exe), How can I dump the unpacked code and fix imports? Thanks.

Answer 1

I would recommend using the starting address of the lpbuffer from WriteProcessMemory function and than setting OllyDump to that address (3rd option below Module) : After that if needed you can fix the IAT table with a tool like: Scylla