1

I'm facing a problem that i need to dump a large region of memory with IDA pro

using xdbg its easily done by going to memory map tab and just dumping a region, how can i do this in IDA pro? for example dump from address x to y

I tried to use a simple IDApython script but if the size is large IDA will just crash (I'm dumping a large region while remotely debugging a windows kernel)

filename = AskFile(1, "*.bin", "Output file name")
address = startAddress
size = 0xFFFFFF
dbgr = True
with open(filename, "wb") as out:
    data = GetManyBytes(address, size, use_dbg=dbgr)
    out.write(data)
  • Did you try to dump the region by parts? – w s Jul 1 at 7:56
  • @ws No, do you mean put a loop and split the region into pieces? – Mery Ted Jul 1 at 8:10
  • yes, definitely – w s Jul 1 at 8:39
  • 1
    @ws yes this is i actually did at the end and found out there was a problematic region in the kernel for some reason – Mery Ted Jul 3 at 16:52
1

Without scripting:

  1. Select the range:

Go to start of the area, press Alt+L, go to the end

  1. Edit, Export data (or Shift+E)

  2. pick "raw bytes" and enter filename in the Outpuf File field.

With scripting:

idc.savefile(filename, 0, startAddress, size)
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.