2

I attached a Visual Studio 2015 debugger to a process and want to dump a specific memory section to a file (unsigned char array, contains binary image data). Is something like that possible?

edit: I dumped the array using HxD (Hex editor). Searched for the start of the array (by searching a long sequence of the start of the array) and selected the array length, seems kind of hacky tho.

CalibeR.50
  • 370
  • 2
  • 13
  • As an aside you may want to look at WinDbg the [`.writemem`](https://msdn.microsoft.com/en-us/library/windows/hardware/ff566176(v=vs.85).aspx) cmd is designed specifically for this – EdChum Oct 13 '15 at 08:30
  • @EdChum is WinDbg installed alongside with VS? – CalibeR.50 Oct 13 '15 at 09:11
  • No, you either install the platform SDK or you can just get it from here: http://debugging.wellisolutions.de/windbg-versions/. Basically install it, attach, debug as normal then call `.writemem` with path and memory range. – EdChum Oct 13 '15 at 09:12
  • Ok, will have a look at this. Would be really nice to have a option to dump memory inside VS tho, as I'm already at the exact memory location in memory view. – CalibeR.50 Oct 13 '15 at 09:26

1 Answers1

-1

It is.

When the debugger has stopped at an exception or at a breakpoint, click Debug and choose Save Dump As...

In the Save as type list, you can select Minidump or Minidump with Heap (the default).

dspfnder
  • 1,135
  • 1
  • 8
  • 13