Skip to content

A program written in C++ for remotely dumping manual mapped modules.

Notifications You must be signed in to change notification settings

gmh5225/mapped-dumper

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

5 Commits
 
 
 
 

Repository files navigation

Manual Mapped Module Dumper

A program written in C++ for remotely dumping manual mapped modules.

Brief Explanation

When you want to inject a module into a process and you don't want it to be found by typical routines (load notifications, tls callbacks, etc) you use manual mapping to get your module into the process. This is a tool I wrote to dump said modules for an anti-cheat I was developing to gain knowledge on the internals of Windows. It iterates through memory pages and does some simple checking on permissions and flags to determine if it's a mapped module. This isn't perfect, if the PE header memory is released then it'll need a few lines changed, none-the-less it was useful for dumping many P2C's which were utilizing BlackBone to inject for testing my detection routines.

About

A program written in C++ for remotely dumping manual mapped modules.

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages