Skip to content

MemPE v0.1.4

Choose a tag to compare

@techlinn techlinn released this 28 Jul 01:38
· 23 commits to main since this release

This release makes mempe say more about the images it dumps, and fixes several
bugs found while going back over the code.

The output now names the entry point and the section holding it. On a packed
target that shows whether execution still begins inside the stub. A normal
process lands in .text; the packed test binary lands in the packer's own
section. TLS callbacks are counted as well, since protectors use them to run
code before the entry point. Section names made of raw bytes are replaced with
.secNN, so nothing unprintable reaches the tools that read the dump.

Recovered imports no longer cost a working dump. 0.1.3 ran import recovery on
images that already had a valid import table, and when the headers had no room
for another section the rebuild failed outright. Large images such as
mscorlib.ni.dll were lost that way. The existing table is now kept instead.

An export name RVA of zero is no longer treated as a string. It resolved to the
DOS signature, so an image with a stripped export name was written out as
MZ.exe and its exports were attributed to a module that does not exist.
Packers often clear that field.

Hidden image discovery no longer dumps a second PE that the first one already
covers, and an allocation that fails the size limit is skipped rather than
ending the capture.

Watch mode no longer creates the output folder before it starts waiting.
Invalid command line values are quoted in errors, and the help text states the
24 hour watch limit.

The PID and process name workflows work the same as before. The release build
passed all 34 tests.