# dumpulator

> Python library that emulates user-mode code from minidumps of 64-bit and 32-bit Windows processes with Unicorn. Because the dump supplies the full process memory, only system calls are emulated, and analysts can call functions, run code between two addresses, trace instructions and read results such as decrypted strings. The README presents it for malware analysis, such as configuration extraction and unpacking, and for dynamic analysis generally; syscalls can be reimplemented or hooked in Python with typed structure declarations.

- Type: Tool
- Targets: Binary
- Category: Debugging and dynamic analysis
- Relationship: Foundation tool
- Sources reviewed: 2026-10-20
- Added to the catalog: 2026-11-09
- Original resource: <https://github.com/mrexodia/dumpulator>
- Primary source: <https://github.com/mrexodia/dumpulator/blob/18a64d7ab6ccded24c5ffe72ba17ac03fd853f8b/README.md>
- Catalog page: <https://awesomerea.org/resources/dumpulator/>
- Record JSON: <https://awesomerea.org/resources/dumpulator/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/dumpulator/index.md)

## Requirements & limits

- The README calls dumpulator a prototype. PyPI release 0.2.6 and the source setup.cfg version 1.0.0 differ; version 1.0.0 has no release.
- Input is a full-memory minidump of the analyst’s target process. At the pinned commit, 38 of 463 declared Zw* syscalls have handlers; the others raise NotImplementedError.
- Python 3.9+, unicorn ~=2.0.0, pefile and capstone ~=4.0.2. A patched minidump parser is vendored. CI tests on Windows Server 2019 with Python 3.9.
- CI downloads project-hosted x64 and x86 test minidumps and runs the getting-started scripts and exception tests. The full-process fixtures include loaded Windows system modules.
- LICENSE is BSL-1.0. Emulation reflects one memory snapshot and the implemented syscalls.

## Primary sources

1. <https://github.com/mrexodia/dumpulator/blob/18a64d7ab6ccded24c5ffe72ba17ac03fd853f8b/README.md>
2. <https://github.com/mrexodia/dumpulator/blob/18a64d7ab6ccded24c5ffe72ba17ac03fd853f8b/setup.cfg>
3. <https://github.com/mrexodia/dumpulator/blob/18a64d7ab6ccded24c5ffe72ba17ac03fd853f8b/src/dumpulator/ntsyscalls.py>
4. <https://github.com/mrexodia/dumpulator/blob/18a64d7ab6ccded24c5ffe72ba17ac03fd853f8b/src/dumpulator/dumpulator.py>
5. <https://github.com/mrexodia/dumpulator/blob/18a64d7ab6ccded24c5ffe72ba17ac03fd853f8b/src/minidump/README.md>
6. <https://github.com/mrexodia/dumpulator/blob/18a64d7ab6ccded24c5ffe72ba17ac03fd853f8b/.github/workflows/build.yml>
7. <https://github.com/mrexodia/dumpulator/blob/18a64d7ab6ccded24c5ffe72ba17ac03fd853f8b/tests/download_artifacts.py>
8. <https://github.com/mrexodia/dumpulator/tree/18a64d7ab6ccded24c5ffe72ba17ac03fd853f8b/tests/DumpulatorTests>
9. <https://github.com/mrexodia/dumpulator/blob/18a64d7ab6ccded24c5ffe72ba17ac03fd853f8b/LICENSE>
10. <https://pypi.org/project/dumpulator/0.2.6/>
11. <https://github.com/mrexodia/dumpulator/releases/tag/artifacts>

## More in Native binaries

- [McSema](https://awesomerea.org/resources/mcsema/index.md) · Tool
- [retoolkit](https://awesomerea.org/resources/retoolkit/index.md) · Tool
- [D-810 ng](https://awesomerea.org/resources/d810-ng/index.md) · Tool
- [Anvill](https://awesomerea.org/resources/anvill/index.md) · Tool
- [XRefer](https://awesomerea.org/resources/xrefer/index.md) · Tool
- [dsdump (paradiseduo wrapper)](https://awesomerea.org/resources/paradiseduo-dsdump/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.