Simple, fully external, smart, fast, JSON-configurated, feature-rich Windows x86 DLL Memory Dumper with Code Generation. Written in Modern C++.

altdumper CPP PLATFORM

Simple, fully external, smart, fast, JSON-configurated, feature-rich Windows x86 DLL Memory Dumper with Code Generation. Written in Modern C++.

Features

  • Fully external (Binary based)

    • You're not required to run any program other than altdumper to generate your values from a config. You just need according binaries.
  • Code generation

    • Your config output automatically generates to valid, no-cost (compile-time) variables.
    • This component can be used independently.

    • Currently supported languages are:
      • C++

  • JSON-configurated

    • The inputs are very human friendly (meaning, you can edit your configs by hand) and ideal for usage on a server.
    • This also makes it pretty portable, without any official support for editing, as it is incredibly intuitive.
  • Fully user assisting

    • You will be walked through both the process of generating a JSON configuration for making, and throughout inputting it. The process is a dialogue, and you'll have file/folder prompts when required, name inputting when required, value inputting when required, and you'll also have instructions at hand, in the CLI.
  • Multi-threaded

    • The processing of every individual DLL is spanned across their own thread.
  • Pattern scanning


    • Keep in mind: Scanning here is done only throughout the .text section.

    Prompts you to input the following:

    • IDA-style string of pattern (example: "AA BB CC DD EE ? FF").
      • ? is the 'ignore mismatch' wildcard.
    • N-th instance of pattern (given it repeats).
      • Default value is 0 (first one).
    • Padding (from first pattern byte).
    • Dereferences (from pattern start + padding).
  • String-search scanning

    Prompts you to input the following:
    • String to find in .rdata. Input is null terminated.
    • Section where to scan for the references.
    • Reference instance (N-th reference in .text of the address where our string is stored).
    • Padding (to skip over reference pointer, you would input 4).
    • Dereferencing (from padding).
  • Procedure scannign

    Prompts you to input the following:
    • Export procedure name.
  • Misc scanning

    • ConVar scanning

      Prompts you to input the following:
      • Name of ConVar.
      • Whether is it server bounded or not (to deduce the constructor).
        • A server-bounded ConVar example is: cl_cmdrate.
        • A non-server-boudned ConVar example is: r_aspectratio.

Example config (CS:GO)


  • You'll have to change the DLL paths by hand, currently, if you want to use this, or any other config that you didn't configure! There is currently no 'edit' mode, anywho, it shouldn't be an issue.

{
  "D:\\SteamLibrary\\steamapps\\common\\Counter-Strike Global Offensive\\bin\\engine.dll": {
    "convars": {
      "pp_cmdrate_cvar": {
        "name": "cl_cmdrate",
        "server-bounded": true
      },
      "pp_aspect_ratio_cvar": {
        "name": "r_aspectratio",
        "server-bounded": false
      }
    },
    "procedures": {
      "p_create_interface": {
        "name": "CreateInterface"
      }
    },
    "signatures": {
      "p_global_vars": {
        "dereferences": 1,
        "nth-match": 0,
        "padding": 1,
        "signature": "68 ? ? ? ? FF 35 ? ? ? ? FF 10 8A"
      }
    },
    "string-search": {
      "p_engine_client": {
        "dereferences": 0,
        "padding": -8,
        "reference-instance": 0,
        "section": ".data",
        "string": "VEngineClient014"
      },
      "ppp_localize": {
        "dereferences": 0,
        "padding": -4,
        "reference-instance": 0,
        "section": ".data",
        "string": "Localize_001"
      }
    }
  }
}

License

WTFPL

Owner
cristei
For inquiries, preferably, contact me on Twitter, or, by e-mail. 16.
cristei
Similar Resources

Collection of DLL function export forwards for DLL export function proxying

dll-exports Collection of DLL function export forwards for DLL export function proxying. Typical usecase is for backdooring applications for persisten

Sep 14, 2022

A method from GH on how to stream a dll without touching disk, TAGS: fortnite cheat fortnite injector dll injector

A method from GH on how to stream a dll without touching disk, TAGS: fortnite cheat fortnite injector dll injector

dll-encryptor People who make pay hacks typically have down syndrome and are incapable of using their brains in any fashion, and yet these bath salt s

Nov 24, 2021

Shared to msvcrt.dll or ucrtbase.dll and optimize the C/C++ application file size.

Shared to msvcrt.dll or ucrtbase.dll and optimize the C/C++ application file size.

VC-LTL - An elegant way to compile lighter binaries. 简体中文 I would like to turn into a stone bridge, go through 500 years of wind, 500 years of Sun, ra

Sep 15, 2022

DLL Hooker using DLL Redirection

DLL Hooker using DLL Redirection

DLLHooker DLL Hooker using DLL Redirection. Development Environment IDE: Visual Studio 2019 Demonstration References [1] https://www.exploit-db.com/do

Jan 21, 2022

A simple PoC to demonstrate that is possible to write Non writable memory and execute Non executable memory on Windows

WindowsPermsPoC A simple PoC to demonstrate that is possible to write Non writable memory and execute Non executable memory on Windows You can build i

Jul 21, 2022

Spotify AdBlocker for Windows, written in C. DLL Injection.

Spotify AdBlocker for Windows, written in C. DLL Injection.

Spotify AdBlock Windows Spotify Ad Block, in C ! Build Open an issue with information related if any error occurs. mingw32-make all Tested gcc: # gcc

Nov 2, 2021

SafetyHook - simple procedure hooking library for Windows x86 and x86_64 systems

SafetyHook SafetyHook is simple procedure hooking library for Windows x86 and x86_64 systems. It aims to make runtime procedure hooking as safe as pos

Sep 8, 2022

💧 A simple x86-64 kernel written in C

HydrOS About HydrOS aims to be a simple yet well documented kernel for the x86-64 architecture. Why HydrOS Hydros (that's why OS looks so nice there)

Sep 16, 2022
Simple one file header for hijacking windows version.dll for desired executable to do 3rd party modifying without dll injection.

Version-Hijack Simple one file header for hijacking windows version.dll for desired executable to do 3rd party modifying without dll injection. Usage

Mar 31, 2022
Rule Engine (RE) creates an interpretable anomaly classifier from many one-feature and two-feature decision rules

Rule Engine (RE) creates an interpretable anomaly classifier from many one-feature and two-feature decision rules

Aug 15, 2022
a small C library for x86 CPU detection and feature extraction

libcpuid libcpuid provides CPU identification for the x86 (and x86_64). For details about the programming API, you might want to take a look at the pr

Sep 7, 2022
A C library for runtime-flippable feature flags on Linux/x86-64, with negligible overhead in the common case

Biased runtime-flippable flags, with cross-modifying code The dynamic_flag library is a two-file "C" library that offers efficient biased conditionals

Aug 5, 2022
A port of the Linux x86 IOLI crackme challenges to x86-64

This is a port of the original Linux x86 IOLI crackme binaries to x86-64. The original set of IOLI crackmes can be found here: https://github.com/Maij

Mar 19, 2022
Calido - Open Smart Thermostat and Smart Home Controller. Built on a Thingy:91 (nRF9160).
Calido - Open Smart Thermostat and Smart Home Controller. Built on a Thingy:91 (nRF9160).

Calido - Open Smart Thermostat and Smart Home Controller based on a Nordic Semiconductor Thingy:91 Project can be found here (Electromaker.io). A Make

Jun 25, 2022
Simple native jvm class dumper written in C by hook ClassLoader
Simple native jvm class dumper written in C by hook ClassLoader

JVM Native Class Dumper Simple native jvm class dumper written in C by hook ClassLoader What is used for? This tool allows you to dump all java classe

Aug 6, 2022
Android Dumper Lib From The Memory

LibDumper This Project Is Using For Make You Easy Dump Lib From The Memory Changelog 3.5 : fixing corrupt file after fixing elf format result dump [st

Jan 27, 2022
Implements a Windows service (in a DLL) that removes the rounded corners for windows in Windows 11

ep_dwm Implements a Windows service that removes the rounded corners for windows in Windows 11. Tested on Windows 11 build 22000.434. Pre-compiled bin

Sep 22, 2022
External CS:GO hack for Arduino written using modern C++ and WinAPI
External CS:GO hack for Arduino written using modern C++ and WinAPI

SQ Project CSGO Arduino Edition External CS:GO hack for Arduino written using C++ and WinAPI. Special thanks to hazedumper for hazedumper. Shock Byte

Sep 14, 2022