glmcdona/Process-Dump

Health v2 · maintenance only

Adoption not part of the score

1852 stars · 282 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Process Dump is a Windows command-line reverse-engineering tool that dumps unpacked malware PE files and loose code chunks from process memory back to disk for static analysis. It reconstructs PE headers and import tables and supports a clean-hash database to skip known-good modules.

Use cases

• dump unpacked malware from memory to disk
• extract hidden modules not properly loaded in a process
• reconstruct PE headers and import tables for loose code chunks
• dump all non-clean modules from all running processes
• capture malware just before a process terminates
• build a clean-hash database to exclude known-good files

When to choose

• analyzing packed or obfuscated Windows malware that unpacks in memory
• extracting injected or hidden code for IDA static analysis
• triaging all running processes on an infected Windows machine

When to avoid

• dumping memory on Linux or macOS
• dynamic analysis or debugging rather than memory extraction
• non-Windows PE analysis without a running target process

Facets

cli-tool · maturity maintenance

reverse-engineering security developer-tools security reverse-engineering windows windows cli malware-analysis memory-dump pe-reconstruction import-reconstruction clean-hash-database

Member repositories

For agents

markdown · JSON · MCP: product_card(name="glmcdona/Process-Dump")