Windows: make a standalone exe process dumper

[trolldbois]

It will be easier than git clone, pip -r requirements, and d/l plenty of requires for no reason.

[trolldbois]

winadppdbg is a win32 requirements for the ptrace-functionallity.

[trolldbois]

Traceback (most recent call last):
File "scripts\haystack-dump", line 18, in
memory_dumper.main(sys.argv[1:])
File "C:\haystack\memory_dumper.py", line 221, in main
opts.func(opts)
File "C:\haystack\memory_dumper.py", line 198, in _dump
return dump(opt.pid, opt.dumpname, opt.type)
File "C:\haystack\memory_dumper.py", line 192, in dump
destname = dumper.dump()
File "C:\haystack\memory_dumper.py", line 69, in dump
self._dump_to_dir()
File "C:\haystack\memory_dumper.py", line 81, in _dump_to_dir
self._dump_all_mappings(self._dest)
File "C:\haystack\memory_dumper.py", line 127, in _dump_all_mappings
self._dump_mapping(m, destdir)
File "C:\haystack\memory_dumper.py", line 170, in _dump_mapping
mmap_fout.write(m.mmap().get_byte_buffer())
File "C:\haystack\mappings\process.py", line 112, in mmap
self._process().readBytes(
AttributeError: 'Process' object has no attribute 'readBytes'

[trolldbois]

mappings.process:L112: s/readBytes/read.
We need a better unix-ptrace/win32-winappdbg interfaces and wrapper

[trolldbois]

And also an issue with protected memory
Traceback (most recent call last):
File "scripts\haystack-dump", line 18, in
memory_dumper.main(sys.argv[1:])
File "C:\haystack\memory_dumper.py", line 221, in main
opts.func(opts)
File "C:\haystack\memory_dumper.py", line 198, in _dump
return dump(opt.pid, opt.dumpname, opt.type)
File "C:\haystack\memory_dumper.py", line 192, in dump
destname = dumper.dump()
File "C:\haystack\memory_dumper.py", line 69, in dump
self._dump_to_dir()
File "C:\haystack\memory_dumper.py", line 81, in _dump_to_dir
self._dump_all_mappings(self._dest)
File "C:\haystack\memory_dumper.py", line 127, in _dump_all_mappings
self._dump_mapping(m, destdir)
File "C:\haystack\memory_dumper.py", line 170, in _dump_mapping
mmap_fout.write(m.mmap().get_byte_buffer())
File "C:\haystack\mappings\process.py", line 115, in mmap
len(self)),
File "C:\haystack\venv\lib\site-packages\winappdbg\process.py", line 1599, in read
raise ctypes.WinError()
WindowsError: [Error 299] Only part of a ReadProcessMemory or WriteProcessMemory request was completed.

[trolldbois]

It might be access related or some sort of memory protection.
http://gojuyou.com/questions/542633/readprocessmemory-with-ctypes

[trolldbois]

or maybe 64bits/32bits

[trolldbois]

Use procdump from sysinternals and the minidump format. #closed