# Get original .dll file from .dmp?

I was wondering if you could get the dll saved into your hard drive from the respective .dmp file. Also if not, is it possible to fully get the asm code from the same .dmp file in addition to it .data/.text sections bin file? By getting the asm code I mean just like you would get if you'd open an unpacked .exe in IDA(So you'd be able to reconstruct functions into c code etc)

• There are 3 questions here : (1) How to reconstruct a dll from a memory dump of the process ? (2) Is it possible to remap the memory dump to recreate the original asm code ? and (3) Can we reconstruct the original functions/methods and decompile them in to C code ? I suggest that this be broken into 3 separate questions, be more specific in your question(s) , and then try to give a concrete example of what you'd researched so far and where you are actually stuck. – TechLord Mar 5 '18 at 5:52

not sure what is respective dump file if you have a .dmp (full kernel memory dump )

and you have loaded it in windbg you can use .writemem command to write back the pages back

a sample

kd> lm m null
Browse full module list
start    end        module name
kd> r cr3
cr3=00039000
kd> ?? @\$proc->Pcb.DirectoryTableBase
unsigned long [2] 0x81291848
0x39000