{
  "added_at": "2026-11-09",
  "additional_evidence_urls": [
    "https://github.com/mrexodia/dumpulator/blob/18a64d7ab6ccded24c5ffe72ba17ac03fd853f8b/setup.cfg",
    "https://github.com/mrexodia/dumpulator/blob/18a64d7ab6ccded24c5ffe72ba17ac03fd853f8b/src/dumpulator/ntsyscalls.py",
    "https://github.com/mrexodia/dumpulator/blob/18a64d7ab6ccded24c5ffe72ba17ac03fd853f8b/src/dumpulator/dumpulator.py",
    "https://github.com/mrexodia/dumpulator/blob/18a64d7ab6ccded24c5ffe72ba17ac03fd853f8b/src/minidump/README.md",
    "https://github.com/mrexodia/dumpulator/blob/18a64d7ab6ccded24c5ffe72ba17ac03fd853f8b/.github/workflows/build.yml",
    "https://github.com/mrexodia/dumpulator/blob/18a64d7ab6ccded24c5ffe72ba17ac03fd853f8b/tests/download_artifacts.py",
    "https://github.com/mrexodia/dumpulator/tree/18a64d7ab6ccded24c5ffe72ba17ac03fd853f8b/tests/DumpulatorTests",
    "https://github.com/mrexodia/dumpulator/blob/18a64d7ab6ccded24c5ffe72ba17ac03fd853f8b/LICENSE",
    "https://pypi.org/project/dumpulator/0.2.6/",
    "https://github.com/mrexodia/dumpulator/releases/tag/artifacts"
  ],
  "category": "dynamic-analysis",
  "description_en": "Python library that emulates user-mode code from minidumps of 64-bit and 32-bit Windows processes with Unicorn. Because the dump supplies the full process memory, only system calls are emulated, and analysts can call functions, run code between two addresses, trace instructions and read results such as decrypted strings. The README presents it for malware analysis, such as configuration extraction and unpacking, and for dynamic analysis generally; syscalls can be reimplemented or hooked in Python with typed structure declarations.",
  "description_zh": "基于 Unicorn 的 Python 库，用于模拟 Windows 64 位和 32 位进程 minidump 中的用户态代码。由于转储提供了完整的进程内存，只需模拟系统调用，分析者即可调用函数、在两个地址之间运行代码、跟踪指令，并读取解密后的字符串等结果。README 将其用于恶意软件分析（如配置提取和脱壳）及一般的动态分析；可用 Python 重新实现或挂钩系统调用，并以类型化方式声明结构体。",
  "entry_url": "https://awesomerea.org/resources/dumpulator/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/dumpulator/",
  "evidence_url": "https://github.com/mrexodia/dumpulator/blob/18a64d7ab6ccded24c5ffe72ba17ac03fd853f8b/README.md",
  "group": "tools",
  "id": "dumpulator",
  "json_url": "https://awesomerea.org/resources/dumpulator/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/dumpulator/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/dumpulator/index.md",
  "name": "dumpulator",
  "name_zh": "dumpulator 内存转储模拟库",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "The README calls dumpulator a prototype. PyPI release 0.2.6 and the source setup.cfg version 1.0.0 differ; version 1.0.0 has no release.",
    "Input is a full-memory minidump of the analyst’s target process. At the pinned commit, 38 of 463 declared Zw* syscalls have handlers; the others raise NotImplementedError.",
    "Python 3.9+, unicorn ~=2.0.0, pefile and capstone ~=4.0.2. A patched minidump parser is vendored. CI tests on Windows Server 2019 with Python 3.9.",
    "CI downloads project-hosted x64 and x86 test minidumps and runs the getting-started scripts and exception tests. The full-process fixtures include loaded Windows system modules.",
    "LICENSE is BSL-1.0. Emulation reflects one memory snapshot and the implemented syscalls."
  ],
  "requirements_zh": [
    "README 称 dumpulator 为原型。PyPI 版本 0.2.6 与源码 setup.cfg 的 1.0.0 版本号不同；1.0.0 尚无发行版。",
    "输入为目标进程的完整内存 minidump。在固定提交中，463 个 Zw* 系统调用声明里有 38 个处理程序，其余会抛出 NotImplementedError。",
    "需要 Python 3.9+、unicorn ~=2.0.0、pefile 和 capstone ~=4.0.2。仓库附带经修补的 minidump 解析器。CI 使用 Python 3.9 在 Windows Server 2019 测试。",
    "CI 下载项目托管的 x64 与 x86 测试 minidump，并运行入门脚本和异常测试。完整进程转储样本包含已加载的 Windows 系统模块。",
    "LICENSE 为 BSL-1.0。模拟范围限于一个内存快照和已实现的系统调用。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/mrexodia/dumpulator",
  "verification": "source-reviewed",
  "verified_at": "2026-10-20"
}