Is there a way to dump a section of process memory knowing the start and end address to raw bin file via a winapi function or some other method? I know that you can do this easily with a debugger, but that's not what I'm looking for.

  • 1
    OpenProcess & ReadProcessMemory + CreateFile & WriteFile
    – josh poley
    Jun 30, 2017 at 20:51

2 Answers 2


I have recently made an API in python to read and write memory - could be useful for a quick solution. https://github.com/samsonpianofingers/pymem

you could use this like this

import pymem

handle = pymem.open_process_name("program.exe")
address = 0x12c0000
size = 1000
buffer = pymem.read_bytes(handle, address, size)
with open("dump.bin", "wb") as f:

you can craft a powershell script in case of emergency (no python no internet only base machine cant install anything whatever )

the code below is rubbish hack you may need to declare proper managed types etc to make it robust it is just to show an idea

$procid = (Get-Process -Name $args[0]).Id
$baseaddr = (Get-Process -Name $args[0] -Module)[0].BaseAddress;
$signature = @"
[DllImport("kernel32.dll")] public static extern IntPtr OpenProcess(
    uint h,bool b ,uint p);
[DllImport("kernel32.dll")] public static extern bool ReadProcessMemory(
    IntPtr hp,IntPtr Base,[Out]Byte[] buff,int Size,[Out]int bread);
$rpm = Add-Type -MemberDefinition $signature -Name rpm -PassThru
[Byte[]] $buff = New-Object Byte[](256)
[int]$bread =0;
$proc = $rpm::OpenProcess(0x001F0FFF,0,$procid);
$read = $rpm::ReadProcessMemory($proc,$baseaddr,$buff,256,$bread);
$a = "";
"{0:X}" -f [int]$baseaddr

running it like

powershell -f foo.ps1 note*
M Z T h i s   p r o g r a m   c a n n o t   b e   r u n   i n   D O S   m o d e .

powershell -f foo.ps1 exp*
M Z T h i s   p r o g r a m   c a n n o t   b e   r u n   i n   D O S   m o d e .

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.