IDA memory dump

0x00 前言

这几天有个需求，要用ida dump内存，我的是ida7.7，在吾爱破解上下载的。百度了一下，发现网上的都用不了，然后整理了一下，供大家使用

0x01 IDC脚本

ida中，按 Shift+F2，输入以下代码，记得修改路径fname

auto fname      = "e:\\dump_mem.bin";
auto address    = 0x233D0140000;
auto size       = 0x16f510;
auto file= fopen(fname, "wb");

savefile(file, 0, address, size);
fclose(file);

0x02 Python脚本

基于 https://github.com/qgy123/IDAMemoryDumper 修改了一个小bug

将下面的脚本拷贝到ida中的plugins目录下，然后重启ida，输入快捷键Ctrl-Alt-M

import ida_kernwin
import idaapi
import idc

act_name = "memdumper:opendump"
label = "Memory dumper"


class MemDumper_t(idaapi.plugin_t):
    flags = idaapi.PLUGIN_PROC
    comment = "MemDumper"
    help = "A plugin to dump the memory region where you wannted from the debugger"
    wanted_name = label
    wanted_hotkey = "Ctrl-Alt-M"

    def init(self):
        self.hextays_inited = False

        print("Memory Dumper (v1.0) by yueluo")
        print("Plugin has been loaded.")

        self.hexrays_inited = True
        return idaapi.PLUGIN_KEEP

    def run(self, arg):
        s = """Memory Dumper

        Enter the memory region:
        
        begin:  <:n::12::>
        
        size:   <:n::12::> (optional, fill it to ignore the end address)        
        or        
        end:    <:n::12::>
        """

        currea = idaapi.get_screen_ea()
        begin = idaapi.Form.NumericArgument('N', currea)
        size = idaapi.Form.NumericArgument('N', 0x0)
        end = idaapi.Form.NumericArgument('N', 0x0)

        ok = idaapi.ask_form(s,
                             begin.arg,
                             size.arg,
                             end.arg)
        if ok == 1:
            print("Begin dump")

            if size.value == 0:
                if end.value <= begin.value:
                    idaapi.warning("Incorrect Address!")
                    return
                else:
                    dumpsize = end.value - begin.value

            else:
                dumpsize = size.value

            print("begin: 0x%x, end: 0x%x" % (begin.value, begin.value + dumpsize))

            path = ida_kernwin.ask_file(True, "*", "Save dump to?")

            if not path:
                return

            print("path: %s" %path)

            if idc.savefile(path, 0, begin.value, dumpsize) != 0:
                idaapi.info("Save successed!")
            else:
                idaapi.warning("Failed to save dump file!")

    def term(self):
        if self.hexrays_inited:
            idaapi.term_hexrays_plugin()


def PLUGIN_ENTRY():
    return MemDumper_t()