1

I'm facing a problem that i need to dump a large region of memory with IDA pro

using xdbg its easily done by going to memory map tab and just dumping a region, how can i do this in IDA pro? for example dump from address x to y

I tried to use a simple IDApython script but if the size is large IDA will just crash (I'm dumping a large region while remotely debugging a windows kernel)

filename = AskFile(1, "*.bin", "Output file name")
address = startAddress
size = 0xFFFFFF
dbgr = True
with open(filename, "wb") as out:
    data = GetManyBytes(address, size, use_dbg=dbgr)
    out.write(data)
4
  • Did you try to dump the region by parts?
    – w s
    Jul 1, 2020 at 7:56
  • @ws No, do you mean put a loop and split the region into pieces?
    – Mery Ted
    Jul 1, 2020 at 8:10
  • yes, definitely
    – w s
    Jul 1, 2020 at 8:39
  • 1
    @ws yes this is i actually did at the end and found out there was a problematic region in the kernel for some reason
    – Mery Ted
    Jul 3, 2020 at 16:52

1 Answer 1

1

Without scripting:

  1. Select the range:

Go to start of the area, press Alt+L, go to the end

  1. Edit, Export data (or Shift+E)

  2. pick "raw bytes" and enter filename in the Outpuf File field.

With scripting:

idc.savefile(filename, 0, startAddress, size)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.