.dump (save the virtual memory into a file)
Description of the '.dump' command in HyperDbg.
Command
.dump
Syntax
.dump [FromAddress (hex)] [ToAddress (hex)] [pid ProcessId (hex)] [path Path (string)]
Description
Saves a range of the virtual memory into a file.
Parameters
[FromAddress (hex)]
The start virtual address of where it needs to be dumped.
[ToAddress (hex)]
The end of the virtual address of where it needs to be dumped.
[pid ProcessId (hex)] (optional)
The Process ID in hex format that we want to see the memory from its context (cr3).
[path Path (string)]
The path of where the dump file needs to be saved.
Examples
The following command saves the virtual memory from the address fffff801deadb000
to fffff801deade054
in the file c:\rev\dump1.dmp
.
The following command saves the virtual memory from the address 401000
to 40b000
located at a process with pid equal to 0x1c0 in the file c:\rev\dump2.dmp
.
The following command saves the virtual memory from the address 401000
to 401000+ff00
located at the current process in the file c:\rev\dump3.dmp
.
IOCTL
Remarks
Starting from v0.6, this command was added to the HyperDbg debugger.
This command is guaranteed to keep debuggee in a halt state (in Debugger Mode); thus, nothing will change during its execution.
Requirements
None
Related
Last updated