DMA-PE-Dumper is a DMA capable portable executable dumper that can work over a PCIe FPGA device or if utilizing a Virtual Machine, shared memory or hugepages. It is currently cross compatible with Linux and Windows.

Currently supports the dumping of both x86 and x64 system drivers, native executables, native executables and their dynamic link libraries.

You must have these socket connections configured in your qemu configuration.

-qmp unix:/tmp/qmp-win10.sock,server,nowait

-qmp unix:/tmp/qmp-win10-1.sock,server,nowait

Please note: To have this run successfully on your Linux machine you must configure your backend as such. https://github.com/ufrisk/LeechCore/wiki/Device_QEMU

Please note: To have this run successfully on your Windows machine you must have first met these requirements at https://github.com/ufrisk/LeechCore/wiki/Device_FPGA and at https://github.com/ufrisk/MemProcFS

You can download the compiled versions at https://github.com/Trustings/DMA-PE-Dumper/releases/tag/v1.1.0

git clone --recursive https://github.com/Trustings/DMA-PE-Dumper.git
mkdir build
cd build
cmake ../
make

Download the linux project binaries at https://github.com/Trustings/DMA-PE-Dumper/releases/tag/v1.1.0 and have them extracted to your working build directory

git clone --recursive https://github.com/Trustings/DMA-PE-Dumper.git

After cloning or downloading the repository, open the visual studio solution file (.slnx) and compile as x64 Release.

Download the Windows project binaries at https://github.com/Trustings/DMA-PE-Dumper/releases/tag/v1.1.0 and have them extracted to your working build directory

Once built, cd into the working build directory, input the name of either a system driver, a target exe, or a target exe with an associative dll.

EXAMPLE 1 -> ./DMA-PE-Dumper YourTarget.sys

EXAMPLE 2 -> ./DMA-PE-Dumper YourTarget.exe

EXAMPLE 3 -> ./DMA-PE-Dumper YourTarget.exe YourTarget.dll

For dynamic analysis you can use https://github.com/Trustings/DMA-Memory-Editor