1

I'm looking for a good method to load custom memory dumps (of usermode processes under Windows) into IDA Pro. These memory dumps may be partial or complete - in terms of other DLLs, such as kernel32, being present.

In the past I've attempted writing a Python script (like an *.idc) that'd create an arbitrary amount of segments and fill those with the desired data, but this didn't prove to be a very good technique. Mostly because, in order to run a "Script file", another file needs to be loaded & analyzed by IDA Pro already.

More concretely: I'm looking to build an IDA Pro loader that will load my custom format with the according segments. Architecture should (naturally) be either x86 or x64. Some things will not work as they'd otherwise (e.g., the PE structure may be missing or corrupted). I also don't mind if I have to MakeCode() a number of addresses manually, just loading would be a great start.

Any thoughts / people that have built this before / etc? Thanks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.