pe-dumper 开源项目推荐（7 个）

hasherezade /pe-sieve

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

NASCeria /Brochacha20

A fully static Roblox Client Decryptor

nelj14 /themida-dumper

Generic Themida/WinLicense payload extractor. Launches protected PE as suspended process, detects section decryption, dumps unpacked binary with fixed headers, and scans process memory for IOCs. Supports EXE and DLL targets (x86/x64).

nelj14 /vmprotect-dumper

VMProtect payload extractor with IAT reconstruction. Monitors section unpacking, dumps PE with fixed headers, reconstructs imports via module export enumeration, and scans heap for IOCs. Supports EXE and DLL targets (x86/x64).

xxFURYWOLFxx /veh-dumper

Surgical x64 VEH/VCH dumper. Walks the vectored exception handler list, extracts each handler as a standalone PE64 that IDA opens directly with resolved imports.

plisskien /VMProtect-3.x-Emulator-Memory-Dumper

Sandboxed Qiling/Unicorn emulator & memory dumper for VMProtect 3.x (tested on v3.10.4). Defeats anti-debugging, anti-VM, and KnownDlls integrity scans to unpack fully protected x86_64 PE binaries.

0netdbg /pe-sieve

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).