Tool

dumpulator

Python library that emulates user-mode code from minidumps of 64-bit and 32-bit Windows processes with Unicorn. Because the dump supplies the full process memory, only system calls are emulated, and analysts can call functions, run code between two addresses, trace instructions and read results such as decrypted strings. The README presents it for malware analysis, such as configuration extraction and unpacking, and for dynamic analysis generally; syscalls can be reimplemented or hooked in Python with typed structure declarations.

Targets: Binary
Category: Debugging and dynamic analysis
Relationship: Foundation tool
Sources reviewed: 2026-10-20

Stars: 892
Last commit: 2024-02-02
Language: C
License (GitHub): BSL-1.0

GitHub data as of 2026-11-09

Copy as Markdown View JSON Cite

Requirements & limits

The README calls dumpulator a prototype. PyPI release 0.2.6 and the source setup.cfg version 1.0.0 differ; version 1.0.0 has no release.
Input is a full-memory minidump of the analyst’s target process. At the pinned commit, 38 of 463 declared Zw* syscalls have handlers; the others raise NotImplementedError.
Python 3.9+, unicorn ~=2.0.0, pefile and capstone ~=4.0.2. A patched minidump parser is vendored. CI tests on Windows Server 2019 with Python 3.9.
CI downloads project-hosted x64 and x86 test minidumps and runs the getting-started scripts and exception tests. The full-process fixtures include loaded Windows system modules.
LICENSE is BSL-1.0. Emulation reflects one memory snapshot and the implemented syscalls.

Cite

BibTeX

@misc{dumpulator,
  title = {{dumpulator}},
  howpublished = {\url{https://github.com/mrexodia/dumpulator}},
  url = {https://github.com/mrexodia/dumpulator},
  urldate = {2026-10-20},
  note = {Awesome REA entry: \url{https://awesomerea.org/resources/dumpulator/}}
}

Plain text

dumpulator. https://github.com/mrexodia/dumpulator (accessed 2026-10-20). Awesome REA entry: https://awesomerea.org/resources/dumpulator/

Useful? Star Awesome REA on GitHub2.4k

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

README.md GitHub · mrexodia/dumpulator · Revision 18a64d7
setup.cfg GitHub · mrexodia/dumpulator · Revision 18a64d7
src/dumpulator/ntsyscalls.py GitHub · mrexodia/dumpulator · Revision 18a64d7
src/dumpulator/dumpulator.py GitHub · mrexodia/dumpulator · Revision 18a64d7
src/minidump/README.md GitHub · mrexodia/dumpulator · Revision 18a64d7
.github/workflows/build.yml GitHub · mrexodia/dumpulator · Revision 18a64d7
tests/download_artifacts.py GitHub · mrexodia/dumpulator · Revision 18a64d7
tests/DumpulatorTests GitHub · mrexodia/dumpulator · Revision 18a64d7
LICENSE GitHub · mrexodia/dumpulator · Revision 18a64d7
https://pypi.org/project/dumpulator/0.2.6/
https://github.com/mrexodia/dumpulator/releases/tag/artifacts