Immunity Debug Command to dump memory on demand

dumpit.py

# Simple memory dump script for Immunity debug
# to use this script, put in the PyCommands directory of Immunity Debug
# !dumpit <file name prefix>
#
#
# Dump memory in SZ_LOC list to "C:\\{name}-{address}-manual-dump.bin"
import immlib


SZ_LOCS = [
    (12, 0x09000000),
    (12, 0x09000010),
    (536, 0x10000000),
    (40, 0x10000218),
    (40, 0x10000240),
    (40, 0x10000268),
    (40, 0x10000290),
    (40, 0x100002b8),
    (86528, 0x10001000),
    (43520, 0x10017000),
    (2560, 0x10022000),
    (512, 0x10024000),
    (5120, 0x10025000),
]


FMT = "C:\\{name}-{address}-manual-dump.bin"


def handle_mem_dumps(dbg, regs, name):
    global SZ_LOCS, FMT

    for sz, addr in SZ_LOCS:
        outfile = FMT.format(**{'name': name, 'address': addr})
        dbg.log("Writing NumBytes=0x%08x from BufAddr=0x%08x to %s"%(sz, addr, outfile), regs['EIP'])
        data = dbg.readMemory(addr, sz)
        open(outfile, 'wb').write(data)

    dbg.log("Done dumping the memory", regs['EIP'])


def main(args):
    if len(args) != 1:
        immlib.log("A prefix name is required")
        return "failed to create hooks"

    name = args[0]
    dbg = immlib.Debugger()
    regs = dbg.getRegs()
    handle_mem_dumps(dbg, regs, name)