Support dumping executable files from memory after unpacking
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 331
- Forks
- 33
- PR merge metrics
- No merged PRs in 30d
Description
A common task in malware analysis is to unpack and dump the executable file for further analysis. It would be nice if this operation can be automated within the BN debugger. However, this is a non-trivial work since it requires in depth knowledge of the excusable format and has many pitfalls. Tools like x64dbg rely on an external tool (https://github.com/NtQuery/Scylla) to handle stuff like import reconstruction. Ideally we can somehow incorporate the tool as a debugger plugin.
Related to #420
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No files, tests, or entry points are named in the issue. Start by reading related issue #420 and assessing the proposed debugger-plugin approach and Scylla integration; the work is done only once the scope for dumping unpacked executables and handling import reconstruction is defined and implemented.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- devtools, reverse-engineering
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100