Virtual Section Dumper v1.06
What's VSD?VSD (Virtual Section Dumper) is intented to be a tool to visualize and dump the memory regions of a running 32 bits or a 64 bits process in many ways. For example, you can dump the entire process and fix the PE Header, dump a given range of memory or even list and dump every virtual section present in the process.How to use VSD?When running, VSD lists all the running processes in a the list-view, then, you can use any of the buttons, check-boxes or the pop-up menu to interact with the processes. Here is the list of current features:Main window options:[*]Refresh: refreshes the processes list.
[*]About: displays the about window.
[*]Full Dump: paste header from disk: this option is only valid when you select "Full Dump" over a process. Using this, you can read the originalPE header of a running process from the disk and paste it in memory before dumping. This is specially useful when dealing with packers because they usually change the data in the memory of a packed program, specially the PE header section, to avoid the dumping process.
[*]Full Dump: fix header: this option is only valid when you select "Full Dump" over a process. Using this, you can fix the Raw Offset andVirtual Offset of a process, in other words, Raw Offset == Virtual Offset.
[*]Exclude x64 processes: (Only in the x86 version) when running on Windows 7 (x64), VSD can show you the x64 processes although you can't do too much with them. If you don't want to see these processes you can use this options to filter them from the list.
You can use this feature ONLY when running with Administrative privileges (Vista/Seven/Server 2008 on both platforms, x86 and x64), if not,VSD will show you all the running processes. This is due to VSD can't obtain a handle via OpenProcess to interact with the processes (note: if you know what I'm talking about and you have an idea on how to improve/solve this problem, just email me).
[*]Total number of processes: prints the total number of running processes.
[*]Sort process by Name, PID, ImageBase or ImageSize: you can sort the list of processes by doing click in the top of every column.
Pop-up menu options:
[*]Select All: selects all the processes on the list.
[*]Copy to Clipboard: copies the selected items to the clipboard.
[*]Dump Full: dumps the entire process' memory to disk.
[*]Dump Partial: dumps a partial memory region to disk. You must enter a valid address and size.
[*]Dump Regions: displays the regions windows where you can interact with all the virtual sections of the process.
[*]Kill Process: terminates the execution of the selected process.
[*]Refresh: refreshes the process list.
Dump Regions window options:
[*]Sort virtual sections by Address, Size, Protect, State or Type: by clicking on the top of every column, you can sort the data listed in the list-view.
[*]Dump: dumps the selected virtual section. Not all sections can be dumped, for example, a section marked as free can't be dumped.
[*]Refresh: refreshes the sections list.
[*]Close: closes the sections window.
Project InformationVSD was tested under Windows XP Professional SP3, Windows 7 Ultimate (x86 & x64), wine under Ubuntu 11.04 x64.GreetingsAs always, I have to thank a lot of people without whom this tool had not seen the light.Many, many thanks to:
[*]marciano: for being my friend, beta tester and for reporting a lot of bugs and features.
[*]MCKSys Argentina: for being my other beta tester.
[*]Guan De Dio: for his opinions to improve each of my tools :P
[*]Nacho_dj: for being a friend in ARTeam and for supporting me.
[*]Shub-Nigurrath: for being an amazing friend, for teaching me with his tutorials and for supporting me.
[*]To all my friends in CLS, ARTeam, SnD, B@S, OpenRCE, exetools and Woodmann.
Latest changesVSD x86Version: 1.1
[*]Fixed a bug in the PastePEHeader() function when calculating the offset of the original PE Header.
Version: 1.0
[*]First stable release (I hope so :)
VSD x64Version: 1.0
[*]First stable release.
ScreenshotsVSD x86https://lh4.googleusercontent.com/-L6TsBn4IIm8/Tz3WbI22aXI/AAAAAAAAAEQ/cFhL71-Stao/s547/vsd_win32.JPGVSD x64https://lh5.googleusercontent.com/-VlqHVpcI5vM/T0Qu7MqM7lI/AAAAAAAAAEw/KOD8a5s-hng/s626/vsd_x64.png
Downloads:
http://code.google.com/p/virtualsectiondumper/downloads/list
室间隔缺损是什么？
室间隔缺损（虚拟组自卸车） intented是一个工具，可视化和倾倒在运行32位或64位过程中，在许多方面的内存区域。例如，你可以转储整个过程和修复PE头，内存转储给定的范围内，甚至列出并倾倒在这个过程中的每一个虚拟节礼物。
如何使用室间隔缺损？
运行时，VSD列表中的所有正在运行的进程列表视图，然后，你可以使用任何按钮，检查框或弹出菜单交互进程。这是当前功能的列表：
主窗口选项：
刷新：刷新进程列表。
关于：显示窗口。
完全转储：糊头盘：当您选择“多进程“完全转储，这个选项是唯一有效的。用这种方法，你可以读取原始的PE头从磁盘中的一个正在运行的进程，并粘贴在内存中为之倾倒。时处理组的 ERS因为他们通常会改变一个打包程序的内存中的数据，特别是PE文件头部分，以避免反倾销的进程，这是特别有用。
完全转储：修复头：当您选择“多进程“完全转储，这个选项是唯一有效的。用这种方法，你可以修复原始偏移量，虚拟偏移的一个过程，换句话说，原始偏移 == 虚拟偏移。
排除64的过程：（仅适用于x86版本）的Windows 7（64）运行时，VSD可以显示您在x64进程，但你不能这样做与他们的太多。如果你不希望看到这些过程，您可以使用此选项来过滤他们从列表。
只有当与运行的管理权限（Vista中/七/服务器2008年这两个平台上，x86 和 x64 ），您可以使用此功能，如果没有，VSD将显示所有正在运行的进程。这是由于室间隔缺损，不能获得通过的句柄调用OpenProcess互动的过程（注：如果你知道我在说什么，你有一个想法就如何改善/解决这个问题，只是给我发电子邮件）。
打印进程总数：正在运行的进程总数。
按名称排序过程中，PID的ImageBase或的ImageSize：你可以排序的进程列表，通过点击每一列的顶部。
弹出式菜单中选择：
全选：选择名单上的所有进程。
复制到剪贴板：所选项目复制到剪贴板。
转储全部：整个进程的内存转储到磁盘。
部分转储：转储到磁盘部分内存区域。你必须输入一个有效的地址和大小。
的转储地区：显示区域窗口，在那里你可以交互的所有进程的虚拟部分。
杀死进程：终止执行选定的进程。
刷新：刷新进程列表。
倾倒区的窗口选项：
排序的地址，面积，保护，国家或类型的虚拟部分：通过点击每一列的顶部，你可以在列表视图中列出的数据进行排序。
转储：转储选定的虚拟部分。不是所有的部分可以倾倒，例如，标记为空闲节不能被倾倒。
刷新：刷新的部分清单。
关闭：关闭部分窗口。
项目信息
VSD的测试在Ubuntu 11.04 64位的Windows XP专业版SP3，Windows 7旗舰版（X86和X64），酒下。
问候
一如往常，我要感谢很多人没有他们，这个工具还没有看到光。
很多，千恩万谢：
马西亚诺：为我的朋友，beta测试，并报告了很多缺陷和功能。
MCKSys阿根廷：我其他的beta测试。
关德迪欧：他的意见，以提高我的工具：P
nacho_dj：作为一个在ARTeam和朋友对我的支持。
shub Nigurrath：教授与他的教程，我和我的支持，是一个了不起的朋友。
到我所有的朋友CLS，ARTeam，SND ， B @ S， ，OpenRCE，exetools和Woodmann。
最新变化
版本：1.1
修复中的的错误PastePEHeader（）函数计算时原始的PE头的偏移量。
版本：1.0
第一个稳定版本（我希望如此:)
室间隔缺损64
版本：1.0
第一个稳定版本。
画面室间隔缺损的x86 额，google翻译么，呵呵
页:
[1]