My question is rather simple, I was analysing a piece of malware packed by some packer in IDA. I have found a memory mapped (via mmap2) region which contains the file I'm interested in. I've created a memory snapshot and I'd like to copy this specific area into a file.

Sadly I haven't been able to find good instructions on how to do this, any help would be most appreciated.

  • Maybe this answer will be helpful: reverseengineering.stackexchange.com/questions/14569/… Only you should save that as binary instead of hex values. I'm only suggesting this because IDA's not that good at exporting EXEs. You may also want to try ollydbg with a dumping plugin.
    – NirIzr
    Apr 15, 2017 at 14:31


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.