wwh1004 / extremedumper

.NET Assembly Dumper

🎉Hello🎉

I'm wwh1004.
Focus on .NET reverse engineering and Windows security.
Also love architecture design and software development.
Programming mainly in C#, C++.

This is my new blog wwh1004.com and knowledge will be shared here.

extremedumper's Issues

如何使用？

请问如何使用这个工具呢？能反混淆dll吗？

suggestion

hi i was wondering if we can make this a console app as well to be able to dump apps using the command line

AntiAntiDebug - Issue

While i was trying to use AntiAntiDebug i get same error on any file.

Question

As there are not much info about this tool.
Just wondering what is purpose of this tool as there is MegaDumper. Is this project some sort improved MegaDumper?
If yes, then what are actual improvements ExtremeDumper vs MegaDumper? Would be good such info to be in readme https://github.com/wwh1004/ExtremeDumper

Unhandled Exception: System.IO.IOException: The handle is invalid.

[LDHK] DllMain: Loaded
[LDHK] DllMain: Monitor created
[LDHK] LoaderHookMonitorLoop: Found nLoadImage at 74D26310 by ECall
[LDHK] InstallHook: 1
[LDHK] LoaderHookMonitorLoop: LDHK_MONITOR_CLR at 74D26310

Unhandled Exception: System.IO.IOException: The handle is invalid.

at System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)
at System.Console.GetBufferInfo(Boolean throwOnNoConsole, Boolean& succeeded)
at System.Console.Clear()
at Colorful.Console.Clear()
at Main.Menu()
at Program.Main(String[] args)

In memory injection

Hello, I created an injector dll with dnlib inside the memory and wanted to inject the byte array into process without writing it to a temp directory. It seems in the function WriteMachineCode is not able to loadlibrary without assemblyPath.
return pRuntimeHost->ExecuteInDefaultAppDomain(L"assemblyPath", L"typeName", L"methodName", L"argument", pReturnValue);

I think if you write the dll into process memory and change that function wrapper to this

_AppDomainPtr spDefaultAppDomain = NULL;
if (pCorRuntimeHost->GetDefaultDomain(&spAppDomainThunk) != S_OK)
{
    _AssemblyPtr spAssembly = NULL;
    return  spDefaultAppDomain->Load_3(safeArray, &spAssembly)) {
    }
}

we shall use in memory injection and benefit from faster execution and eliminating the unnecessary use of reading and writing form hard drive and keeping the injector more covert.
here is the link to the full article.
Common Language Runtime In Memory Execution
CLR.hpp
Thanks in advance.

.Net 程序，但无法检测到clr

我这里有一个程序，确实是.Net的，反编译后能得到类型成员，但无法得到方法内具体代码
用这个软件查看后是检测不到clr的，也无法dump
请问可以发你看看吗

Emit 动态创建的Dll无法Dumper

试过几次，发现了两个问题：
1、Emit 动态创建的Dll无法Dumper
2、某些软件找不到进程，无法Dumper，可能和加壳有关？