[p4r4n0id]

Hi Guys,

Are you familiar with a Windbg extension / script that dumps 64 bit debugged PE files? I am familiar with dumppe ( https://code.google.com/p/dumppe/ ) but it is 32 bit only.

Another tool needed is ,again, a Windbg extension which is able to change page protections for 64 bit as well.

Any ideas ? :)

Thx,

p4r4n0id

[_glmcdona]

I recently wrote a tool that dumps 64 bit PE files from memory to disk, though it is not a windbg plugin:
- http://split-code.com/processdump.html

Just use it and specify the process pid or process name to dump the PE files in it's address space back to disk.

[EreTIk]

My extension: http://eretik.omegahg.com/download/KdExtMod.rar
Usage: !pedump addr fileName
Description (rus): http://eretik.omegahg.com/kd/pedump.html

[p4r4n0id]

My extension: http://eretik.omegahg.com/download/KdExtMod.rar
Usage: !pedump addr fileName
Description (rus): http://eretik.omegahg.com/kd/pedump.html

Thx a lot bro!! will let u know how it goes ;)

p4r4n0id