reverseame/windows-memory-extractor

Tool to extract contents from the memory of Windows systems.

windows-memory-extractor's Issues

Incorporate a "file-version-info,i" option

In addition to obtaining the memory content of a module, it is also interesting to obtain the version information of the file to which it corresponds. Once the module is retrieved, MODULEENTRY32 has an attribute (specifically, szExePath) which allows you to get a reference to the corresponding file on disk. With this, you can get the file version information via GetFileVersionInfo and VerQueryValue (see some code examples here).

When this option is given, you can generate another file in the output directory (for example, ending with .fileinfo extension) in which all the possible file version info is saved.

--join argument only works with --module argument

The optional --join argument works smoothly with the --module argument to extract a module from a given process PID. Unfortunately, the main module (from the process image file) cannot be extracted into a single file as in the case of modules. It would be great if we could run the tool as

.\WindowsMemoryExtractor_x64.exe --pid 1234 --join

And get a single file with the entire memory dump of the main module. I think GetProcessImageFileName can do the job, after getting the process handle by means of OpenProcess.