JMI
April 3rd, 2008, 17:24
FKMA has apparently released a newer version of his OllyDbg PE Dumper, now apparently known as Imm_OllyDbg PE Dumper 3.03
His updated version has the following description:
you can dump any *.exe and *.dll from debugged process address space;
- you can add/remove sections to/from resulting dump. If you are add new section,
you specify VA and size of memory region to add as section, attributes, File Offset,
RAW size and section name. So, now you can add to dump any memory regions created
by protectors during debug session;
- antidump antiprotection and most correct save dump technics: during dumping,
against other dumpers, PE Dumper save only present memory pages (basing on VA & Virtual size).
So, if between memory regions present non-allocated space, most other dumpers
(and OllyDump too) will not save dump correctly, but PE Dumper will save all
correctly.
- fix raw sizes correct only RAW size of image according to Virtual Sizes;
- paste header from disk - use header from disk, it's clear;
I found it at:
http://www.tuts4you.com/download.php?view.2109
and updated our CRCETL entry and local copy here:
http://www.woodmann.com/collaborative/tools/PE_Dumper
Regards,
His updated version has the following description:
you can dump any *.exe and *.dll from debugged process address space;
- you can add/remove sections to/from resulting dump. If you are add new section,
you specify VA and size of memory region to add as section, attributes, File Offset,
RAW size and section name. So, now you can add to dump any memory regions created
by protectors during debug session;
- antidump antiprotection and most correct save dump technics: during dumping,
against other dumpers, PE Dumper save only present memory pages (basing on VA & Virtual size).
So, if between memory regions present non-allocated space, most other dumpers
(and OllyDump too) will not save dump correctly, but PE Dumper will save all
correctly.
- fix raw sizes correct only RAW size of image according to Virtual Sizes;
- paste header from disk - use header from disk, it's clear;
I found it at:
http://www.tuts4you.com/download.php?view.2109
and updated our CRCETL entry and local copy here:
http://www.woodmann.com/collaborative/tools/PE_Dumper
Regards,