Posted May 11, 20187 yr What it does It' simply shows in the hex dump the second section in the hex dump at startup (it's not a hell of a feature and this is my first plugin/c++ project) How it works the plugin wait for the fisrt PAUSDEBUG event, gets the base address of main module, read the second section RVA from the header using DbgMemRead Update the plugin will look for the first writable section and show it in dump, if none is found it shows the second section Download https://github.com/cobrce/DataDump/releases/ p.s : if there is a simpler way to do its work please tell me Edited May 11, 20187 yr by cob_258 update
Create an account or sign in to comment