1

Is there a way to dump a section of process memory knowing the start and end address to raw bin file via a winapi function or some other method? I know that you can do this easily with a debugger, but that's not what I'm looking for.

  • 1
    OpenProcess & ReadProcessMemory + CreateFile & WriteFile – josh poley Jun 30 '17 at 20:51
1

I have recently made an API in python to read and write memory - could be useful for a quick solution. https://github.com/samsonpianofingers/pymem

you could use this like this

import pymem

handle = pymem.open_process_name("program.exe")
address = 0x12c0000
size = 1000
buffer = pymem.read_bytes(handle, address, size)
with open("dump.bin", "wb") as f:
    f.write(buffer)
    f.flush()
    f.close()
2

you can craft a powershell script in case of emergency (no python no internet only base machine cant install anything whatever )

the code below is rubbish hack you may need to declare proper managed types etc to make it robust it is just to show an idea

$procid = (Get-Process -Name $args[0]).Id
$baseaddr = (Get-Process -Name $args[0] -Module)[0].BaseAddress;
$signature = @"
[DllImport("kernel32.dll")] public static extern IntPtr OpenProcess(
    uint h,bool b ,uint p);
[DllImport("kernel32.dll")] public static extern bool ReadProcessMemory(
    IntPtr hp,IntPtr Base,[Out]Byte[] buff,int Size,[Out]int bread);
"@
$rpm = Add-Type -MemberDefinition $signature -Name rpm -PassThru
[Byte[]] $buff = New-Object Byte[](256)
[int]$bread =0;
$proc = $rpm::OpenProcess(0x001F0FFF,0,$procid);
$read = $rpm::ReadProcessMemory($proc,$baseaddr,$buff,256,$bread);
$a = "";
$a+=[char[]]$buff[0..1]+[char[]]$buff[78..118]
$procid
"{0:X}" -f [int]$baseaddr
$a

running it like

powershell -f foo.ps1 note*
3388
8D0000
M Z T h i s   p r o g r a m   c a n n o t   b e   r u n   i n   D O S   m o d e .

powershell -f foo.ps1 exp*
304
C40000
M Z T h i s   p r o g r a m   c a n n o t   b e   r u n   i n   D O S   m o d e .

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.