glmcdona/process-dumpWindows tool for dumping malware PE files from memory back to disk for analysis.
Process Dump is a Windows reverse-engineering command-line tool to dump malware memory components back to disk for analysis. Often malware files are packed and obfuscated before they are executed in order to avoid AV scanners, however when these files are executed they will often unpack or inject a clean version of the malware code in memory. A common task for malware researchers when analyzing malware is to dump this unpacked code back from memory to disk for scanning with AV products or for analysis with static analysis tools such as IDA.
Process Dump works for Windows 32 and 64 bit operating systems and can dump memory components from specific processes or from all processes currently running. Process Dump supports creation and use of a clean-hash database, so that dumping of known files such as kernel32.dll can be skipped. Its main features include:
-closemon), where hooked processes will be paused and dumped just before they terminate.I'm maintaining an official compiled release on my website here: https://split-code.com/processdump.html
You can download the latest compiled release of Process Dump here:
Use pd64.exe on 64-bit Windows (recommended), or pd32.exe on 32-bit Windows. Both binaries are standalone; no Microsoft Visual C++ Redistributable is required.
Process Dump can dump all unknown code from memory (-system), dump specific processes, or monitor processes and dump them before they terminate.
On a clean workstation, generate a baseline database with either:
pd64.exe -db genquickpd64.exe -db genRun database generation and dumping as separate commands. For best access, run as Administrator. The default worker count is 16.
Example usage:
pd64.exe -systempd64.exe -pid 419pd64.exe -pid 0x1a3pd64.exe -pid 0x1a3 -a 0x401000 -o C:\dumpspd64.exe -p "chrome[.]exe"pd64.exe -p ".*chrome.*"pd64.exe -closemonGeneral Dumping Options
| Option | Description |
|---|---|
-system | Dumps modules and loose code not matching the clean hash database from all accessible processes. |
-pid <pid> | Dumps a specific process. Use decimal or a 0x prefix for a hexadecimal PID. |
-closemon | Hooks process termination and dumps before exit. Use in a controlled environment; press Ctrl+C to stop. |
-p <regex> | Dumps processes whose entire name matches a case-sensitive regular expression. Multiple matches prompt for confirmation. |
-a <address> | Dumps at the specified base address. Requires -pid; accepts decimal or 0x-prefixed hex. |
-o <path> | Sets the output folder (default: current working directory). Create the folder first; existing files are never overwritten. |
Clean Hash Database Options
Database files default to the application directory: clean.hashes, entrypoints.hashes and shortentrypoints.hashes.
| Option | Description |
|---|---|
-db gen | Adds hashes from running processes and PE files recursively in %WINDIR%, %USERPROFILE%, C:\Program Files and C:\Program Files (x86). |
-db genquick | Adds hashes from running processes only. Faster than gen, but less complete. |
-db add <dir> | Adds PE file hashes from the specified directory recursively, including entrypoint signatures. |
-db remove <dir>, -db rem <dir> | Removes matching clean-module hashes from the directory recursively. Entrypoint signatures are retained. |
-nr | Disables recursion for database add/remove commands. Does not affect -db gen. |
-db clean | Clears all three databases, including entrypoint signatures. |
-db ignore | Ignores all three loaded databases for this dump without changing the files. Repeated modules may still be skipped within the run. |
-cdb <filepath>, -c <filepath> | Sets the clean hash database path. |
-edb <filepath> | Sets the entrypoint hash database path. |
-esdb <filepath> | Sets the short entrypoint hash database path. |
Output Options
| Option | Description |
|---|---|
-v | Prints verbose diagnostics. |
-nh | Suppresses the version/copyright banner. |
--help, -help, -h, --h | Prints help and exits. Running without arguments also prints help. |
Advanced Options
| Option | Description |
|---|---|
-g | Forces generation of both 32-bit and 64-bit PE headers, ignoring existing headers. |
-eprec | Forces entrypoint recovery even if a valid entrypoint exists. Recovery is heuristic; an unsuccessful search leaves the old value unchanged. |
-ni | Disables aggressive import reconstruction (enabled by default). |
-nc | Disables loose-code dumping and hashing (enabled by default). |
-nep | Disables entrypoint recovery and live entrypoint hashing, overriding -eprec. File database generation still collects entrypoint signatures. |
-reexec | Experimental preparation for re-running dumps. Discards some captured state and assumes the original section layout; does not run the dump or guarantee it will work. Off by default. |
-nt | Uses one worker, equivalent to -t 1. Close monitoring still has a separate monitoring thread. |
-t <count> | Sets the worker count (default 16, minimum 1) for system dumping, database generation and close monitoring. Direct PID/name dumps remain synchronous. The last -t/-nt wins. |
| Command | Description |
|---|---|
pd64.exe -db genquick | Quickly builds a baseline from currently running processes. |
pd64.exe -system -t 4 -o C:\dumps | Dumps unknown modules and loose code with four workers into an existing output folder. |
pd64.exe -closemon | Runs in terminate monitor mode. |
pd64.exe -pid 0x18A | Dumps modules and loose code from a specific process. |
pd64.exe -p ".*chrome.*" | Dumps processes with names containing chrome. |
pd64.exe -db gen | Builds a more complete baseline from running processes and common folders. |
pd64.exe -db add C:\baseline -nr | Adds PE files from a directory without searching subdirectories. |
pd64.exe -pid 0x1a3 -a 0x401000 | Dumps at a specific address. If no PE header exists, generates both 32-bit and 64-bit headers. |
For malware analysis, use an isolated lab and run Process Dump as Administrator:
pd64.exe -db gen or pd64.exe -db genquick before introducing the sample.pd64.exe -closemon running to capture hooked processes as they terminate.pd64.exe -system to dump processes that are still running.Dumps are written to the working directory unless -o is set. Keep them private. Dumps are for analysis and are not guaranteed to run; images larger than 256 MiB are rejected.
hiddenmodule instead of a module name indicates the module was not properly registered in the process.codechunk means a dump from a loose executable region without a PE header. These are dumped twice, with reconstructed x86 and x64 headers.Example filenames: