Operator On The Wire
Join
← Back to Knowledge Base
BLUE TEAM / MALWARE REVERSE / WINDOWS / WINDBG

Carve Memory

Inspect image size (dump section headers)

!dh <module> -f

Write memory region to file

.writemem payload.bin <BaseAddress> <SizeOfImage>