MemPE v0.4.0

Imports

mempe used to claim two imports kernel32 does not have. The decoder that reads
mov r64,[rip+disp32] treated any cached pointer to an API as a link-time
dependency. Those candidates now need a neighboring pointer slot resolving into
the same module before they count; pointers reached through call or jmp are
accepted as before. Checked against the file on disk, the rebuilt kernel32
import table is an exact match at 1274 entries. Across every dumped System32
DLL, false positives dropped from 748 to 691 and nothing real was lost: 0
missing out of 10700.

An image can no longer be recorded as importing from itself. ntdll was claiming
five imports from ntdll.

Dumps that used to fail

Denied module enumeration used to stop mempe before it captured anything. The
loader module list is now enrichment rather than a requirement: the main image
is identified by its mapped file path, and the degraded mode is reported instead
of inferred.

The 4096-image and 4 GiB safety caps used to abort. They now capture what fits,
always including the main image, and report how many images were skipped.

New

--only <name> or --only 0x<base> writes just the images you want. Every
image is still captured and indexed, so imports resolve exactly as they would in
a full dump; only the files written are filtered.

--raw-regions now writes a sidecar beside each blob giving its load address,
allocation base, committed size and page protections, so a disassembler can be
pointed at the right address. No header is invented for those bytes.

Full mapped paths are kept instead of basenames, which is enough to tell two
same-named DLLs in different directories apart. On explorer it found three.

Measured and left alone

Four suspected limitations turned out not to be. Thunk chains never exceed one
hop across explorer, RuntimeBroker and five test binaries, and nothing was ever
abandoned at the depth limit. Export indexing costs 72 ms of a 5 second explorer
dump. Capture is under a quarter of wall time, so parallelising the reads would
not buy anything. Watch mode never declared a target settled early: private page
counts were identical four seconds later on all four packed samples.

Bound imports turned out to be common rather than legacy, 10836 of 29267 PE
files on a stock Windows 11 install, but mempe never clears that directory. It
came off the list of clears not worth naming, so a real one would be reported.