Dump fail?

Posts 1–5 of 5 · Page 1 of 1
Dump fail?
Well, daum this section is pretty dead.. Might as well ask for help.

Soo... I've been working on this dumper for about a half an hour, and it was about to work until!!! Yeah, the dumped file seems to be corrupted, if I dump a DLL and try to load it with olly it says it can't be loaded. If I dump the executable and try to run it, it says cannot initialize blah blah 0xSomeAddress.

Anyway, heres my code.

[PHP]
#include <iostream>
#include <windows.h>
#include <tlhelp32.h>
#include <fstream>

using namespace std;

DWORD GetProcessID(char* targetProcess)
{
PROCESSENTRY32 *lpEntry;
HANDLE snap = CreateToolhelp32Snapshot(TH32CS_SNAPALL,0);
if(!snap) return 0;
Process32First(snap,lpEntry);
if( !strcmp(targetProcess,lpEntry->szExeFile) )
return lpEntry->th32ProcessID;

while( Process32Next(snap,lpEntry) )
{
if( !strcmp(targetProcess,lpEntry->szExeFile) )
{
return lpEntry->th32ProcessID;
}
}
return NULL;
}

MODULEENTRY32* GetModuleEntry(char* targetModule,DWORD pid)
{
HANDLE snap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE,pid);
MODULEENTRY32* lpModEntry;
Module32First(snap,lpModEntry);
if( !strcmp(targetModule,lpModEntry->szModule) )
return lpModEntry;
while( Module32Next(snap,lpModEntry) )
{
if( !strcmp(targetModule,lpModEntry->szModule) )
return lpModEntry;
}
return NULL;
}

bool DumpModule(MODULEENTRY32* lpModEnt)
{
unsigned char* buffer;
buffer = new unsigned char[lpModEnt->modBaseSize];
HANDLE handle = OpenProcess(PROCESS_VM_OPERATION | PROCESS_VM_READ,0,lpModEnt->th32ProcessID);
if(!handle) return 0;

if(!ReadProcessMemory(handle,lpModEnt->modBaseAddr,buffer,lpModEnt->modBaseSize,0)) return 0;

string dumpedFile = "_";
dumpedFile += lpModEnt->szModule;
fstream Dumping(dumpedFile.c_str(),ios::in | ios:ut | ios::binary | ios::trunc);
for(int i=0;i<lpModEnt->modBaseSize;i++)
{
Dumping<<buffer[i];
}
cout <<"Done";
return true;
}

int main()
{
MODULEENTRY32* lpMod = GetModuleEntry("d3d9.dll",GetProcessID("d3d9test.e xe"));
if(lpMod != NULL)
{
DumpModule(lpMod);
}
cin.get();
}
[/PHP]

Halp!

Note: I'm not sure at all where the problem could be, maybe it's the method it reads or writes the files. Hopefully someone here has already made a module dumper and knows what I'm doing wrong.

Thanks.
When the file is loaded into memory the RVA are replaced with hard addresses. So when the windows loader tries to open it up Im sure the file is a little corrupted. I would use IDA, since it will usually work through that.
Like why said, IDA is probably able to load it.
Any reason I'm not able to run the executables that I dump?
Quote Originally Posted by Void View Post
Any reason I'm not able to run the executables that I dump?
Quote Originally Posted by why06
When the file is loaded into memory the RVA are replaced with hard addresses
AND the modules that were loaded on runtime aren't loaded after you dump+run, so it will point to unused memory.
Posts 1–5 of 5 · Page 1 of 1
This thread is closed for replies.

Similar Threads

Tags for this Thread

None

Talk with us