Tool
netdumper
netdumper extracts loaded .NET assemblies from Windows processes through the CLR Data Access Component. It enumerates AppDomains and assemblies, recovers JIT method IL, converts memory layouts to PE files, and repairs damaged PE headers or metadata streams for subsequent inspection.
- Targets
- Binary
- Category
- .NET tools
- Relationship
- Foundation tool
- Sources reviewed
Requirements & limits
- Prerequisites: Windows, Rust nightly, and the same architecture as the target process are required.
- Limits: Administrator privileges may be required for some processes.
- License: MIT License.
About this entry
The description was reviewed against primary sources.
Primary sources
- README.md GitHub · coconutbird/netdumper · Revision c7ffe79
- Cargo.toml GitHub · coconutbird/netdumper · Revision c7ffe79
More in Apps
- Sandwitcher · Tool
- Zygisk - Frida Gadget · Tool
- Aegis: trace a login-code calculation · Case study
- Notion: trace the clipboard bridge · Case study
- PicoPrint: LX-D02 printer investigation · Case study
- ReaCut: video-editor reconstruction · Case study