1

I was wondering if you could get the dll saved into your hard drive from the respective .dmp file. Also if not, is it possible to fully get the asm code from the same .dmp file in addition to it .data/.text sections bin file? By getting the asm code I mean just like you would get if you'd open an unpacked .exe in IDA(So you'd be able to reconstruct functions into c code etc)

  • 2
    There are 3 questions here : (1) How to reconstruct a dll from a memory dump of the process ? (2) Is it possible to remap the memory dump to recreate the original asm code ? and (3) Can we reconstruct the original functions/methods and decompile them in to C code ? I suggest that this be broken into 3 separate questions, be more specific in your question(s) , and then try to give a concrete example of what you'd researched so far and where you are actually stuck. – TechLord Mar 5 '18 at 5:52
1

not sure what is respective dump file if you have a .dmp (full kernel memory dump )

and you have loaded it in windbg you can use .writemem command to write back the pages back

a sample

kd> lm m null
Browse full module list
start    end        module name
fcad2000 fcad2b80   Null       (pdb symbols)          e:\symbols\null.pdb\77840F8CB3624E438D5D2F0913E4D30E1\null.pdb
kd> r cr3
cr3=00039000
kd> ?? @$proc->Pcb.DirectoryTableBase
unsigned long [2] 0x81291848
0x39000
kd> .writemem c:\null.bin fcad2000 L?(fcad2b80-fcad2000)
Writing b80 bytes..
0

Yes it's possible, but there's no automation of this process. Technically it's similar to the process of unpacking: you get the memory dump of the executable(in you case you need to extract dll from the memory dump), adjust PE header, so that the sections match the offsets in the dump, set OEP if needed, recover import section, recover the relocations.

If you just want to disasm the dll, and not going to reuse the binary, then you may just open dmp file in IDA and find it there among the modules. IDA allows you to disassemble it right in the dump, though you won't be able to apply signatures. And the imports will not be shown, since dmp is a mix of all modules of the process.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.