wwh1004/extremedumper

.NET Assembly Dumper

ExtremeDumper

.NET Assembly Dumper

中文README

Features

• List all processes and highlight .NET processes
• List all modules in a process and highlight .NET modules
• Walk memory pages and dump all valid .NET assemblies
• Dump specified module in modules view
• Inject .NET assembly into any process
• Enhanced anti-dump bypass mode
• .NET assembly loader hook
• Anti title keyword detection
• Portable and only one executable file

Description

View Processes

The default page is process view. You can right click here to dump all .NET modules and view modules in selected process. And also you can click "Inject Dll" to inject a .NET assembly into any process. Any process which contains desktop clr or coreclr will be marked as green.

View Modules

This page show all modules in select process and you can just view .NET modules by click "Only .NET Modules". Any .NET module will be marked as green.

View Exported Functions

This page show exported functions for given module.

Inject .NET Assemblies

Currently the injector supports any .NET Framework assembly with any platform target. And you can pass a string argument to injection main method in injector. In the future it will supports .NET Core.

Bypass Anti-Dump

Before: After:

Usage

Open context menu in modules view and click 'Enable AntiAntiDump'. After enabling it, you can directly and easily dump all .NET assembly which contains anti-dump protection.

Principle

ExtremeDumper will inject core dll into target process and read metadata info from clr internal object. Unlike AntiAntiDump in V2, this one has almost perfect compatibility.

.NET Assembly Loader Hook

Usage

Click 'Open Loader Hook' in main window and you will see 'Loader Hook' window. Select a program to dump and click 'Run With Hook'.

Advanced Usage

Rename 'ExtremeDumper.LoaderHook.dll' to 'version.dll' and put it in the root of the program. It can be loaded in dll hijack mode.

Principle

Loader hook will hook 'clr!AssemblyNative::LoadImage' at startup of the application. When any .NET assembly is loaded by apis like 'Assembly.Load(byte[])', loader hook will save raw byte array to disk.

Downloads

GitHub: Latest release

AppVeyor: Latest build

extremedumper's Issues

In memory injection

Hello, I created an injector dll with dnlib inside the memory and wanted to inject the byte array into process without writing it to a temp directory. It seems in the function WriteMachineCode is not able to loadlibrary without assemblyPath.
return pRuntimeHost->ExecuteInDefaultAppDomain(L"assemblyPath", L"typeName", L"methodName", L"argument", pReturnValue);

I think if you write the dll into process memory and change that function wrapper to this

_AppDomainPtr spDefaultAppDomain = NULL;
if (pCorRuntimeHost->GetDefaultDomain(&spAppDomainThunk) != S_OK)
{
    _AssemblyPtr spAssembly = NULL;
    return  spDefaultAppDomain->Load_3(safeArray, &spAssembly)) {
    }
}

we shall use in memory injection and benefit from faster execution and eliminating the unnecessary use of reading and writing form hard drive and keeping the injector more covert.
here is the link to the full article.
Common Language Runtime In Memory Execution
CLR.hpp
Thanks in advance.

.Net 程序，但无法检测到clr

我这里有一个程序，确实是.Net的，反编译后能得到类型成员，但无法得到方法内具体代码
用这个软件查看后是检测不到clr的，也无法dump
请问可以发你看看吗

Emit 动态创建的Dll无法Dumper

试过几次，发现了两个问题：
1、Emit 动态创建的Dll无法Dumper
2、某些软件找不到进程，无法Dumper，可能和加壳有关？

Unhandled Exception: System.IO.IOException: The handle is invalid.

[LDHK] DllMain: Loaded
[LDHK] DllMain: Monitor created
[LDHK] LoaderHookMonitorLoop: Found nLoadImage at 74D26310 by ECall
[LDHK] InstallHook: 1
[LDHK] LoaderHookMonitorLoop: LDHK_MONITOR_CLR at 74D26310

Unhandled Exception: System.IO.IOException: The handle is invalid.

at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
at System.Console.GetBufferInfo(Boolean throwOnNoConsole, Boolean& succeeded)
at System.Console.Clear()
at Colorful.Console.Clear()
at Main.Menu()
at Program.Main(String[] args)

如何使用？

请问如何使用这个工具呢？能反混淆dll吗？

Question

As there are not much info about this tool.
Just wondering what is purpose of this tool as there is MegaDumper. Is this project some sort improved MegaDumper?
If yes, then what are actual improvements ExtremeDumper vs MegaDumper? Would be good such info to be in readme https://github.com/wwh1004/ExtremeDumper

suggestion

hi i was wondering if we can make this a console app as well to be able to dump apps using the command line

AntiAntiDebug - Issue

While i was trying to use AntiAntiDebug i get same error on any file.