Skip to content
Branch: master
Find file History
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Type Name Latest commit message Commit time
Failed to load latest commit information.
src [REFACT] Printing lists added only if compiled in the debug mode Nov 13, 2017


Small tool for recovering erased imports of a dumped PE file
Useful in recovering executables dumped from the memory. Dedicated to cases when the imports has been destroyed after loading (anti-dumping trick used by malware).

WARNING: This tool covers cases when the names of the imported functions/DLLs are erased. Does not provide rebuilding full import table.


imports_unerase.exe [PID] [dumped_file] [output_file*]
PID - (decimal) PID of the application from where the module was dumped dumped_file - dumped module (in a Virtual format) output_file* - name of the output file (defaule: out.bin) * - optional

This is unfinished/early beta version and it has some limitations, i.e.:

  • works only for PE 32 bit

Compiled version:

You can’t perform that action at this time.