memory-dumper - Dump a process memory and extract data based on re

项目说明

Memory Dumper

Dump a process memory and extract data based on regular expressions. Tool uses multithreading.

Dump and inspect a process memory:

* during inactivity in an application,
* after locking an application,
* after logging out from an application.

Garbage cleaners might not free the unused memory immediately, but should do so after 5-10 minutes after the last action.

CPU and RAM consumption, as well as duration heavily depends on:

* number of memory dump files,
* size of each memory dump file,
* number of regular expressions and their complexity.
* occurrence of each regular expression.

Built with Studio Community 2019 v16.10.2 (64-bit) and tested on Windows 10 Enterprise OS (64-bit).

Made for educational purposes. I hope it will help!

Table of Contents

* How to Run
* Manual Memory Dumping
* Manual Memory Inspection
* rabin2
* strings
* Images

How to Run

Run MemoryDumper_x86.exe (32-bit) or MemoryDumper_x64.exe (64-bit).

Check the example file with regular expressions here.

Manual Memory Dumping

To manually dump a process memory, open Task Manager -> right click on the desired process -> click on Create dump file.

Manual Memory Inspection

The following was tested on Kali Linux v2023.1 (64-bit).

Install the required tools on your Kali Linux:

I prefer using rabin2 over strings.

rabin2

Inspect memory dump, binary, executable, or any other files:

Automate file inspection from the current directory:

strings

Inspect memory dump, binary, executable, or any other files:

Automate file inspection from the current directory:

Images

<p align="center"><img src=" alt="Run"></p>

<p align="center">Figure 1 - Run</p>

项目信息

开发语言：C++

Star 数：9

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Dump a process memory and extract data based on regular expressions.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。