I have a packed executable. To take care of the unpacking, I would like to extract the in-memory version of the process, which would ideally be rolled back into the equivalent Mach-O binary -- such that it can be viewed in a disassembler -- I do not need the unpacked file to be runnable.
A Windows version of the same program exists, and it is also packed. Utilities such as PE Tool make this task simple: you select the process, then the module, and then you have an unpacked binary.
I am not able find any applications that can do this on the OS X side. I can imagine two broad approaches with runtime in mind:
the automatic way PE Tool can generate a binary when given a process and a module
attempting to roll a generic memory dump into the correct Mach-O file of the program's main module
I would appreciate any advice on either of these points. I have an OS X environment at my disposal though I am not familiar with it.
Advice relating to solving this problem through static analysis would also be appreciated
