I am analyzing a binary that is injecting code into another process (i.e., svchost.exe) to make the debugging more tedious. I can attach the new process to a debugger (e.g., ollydbg or the one featured by IDA Pro) and read the assembly code. However, I was wondering whether it is possible or not to take like a snapshot of this so I can later on analyze the code offline (as any other binary).



So your definition of a "snapshot" is somewhat vague. Hopefully my answer matches your idea:

Did you already take a look at the OllyDumpEx Plugin?

This plugin is process memory dumper for OllyDbg and Immunity Debugger. Very simple overview: OllyDumpEx = OllyDump + PE Dumper - obsoleted + useful features

Of course you can simply dump the raw memory as described here with ollydbg itself.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.