New tool: ModuleRescue

re: New tool: ModuleRescue

Sergiu — Thu, 21 Jun 2007 11:47:10 GMT

Is it Open Source ?

Or can you give me some tips about what should i do to implement it's functionality?

I know how to access and process IMAGE_NT_HEADERS and CvRecords....but i don't now how to put it all together.

re: New tool: ModuleRescue

Oleg Starodumov — Thu, 08 Jun 2006 13:07:03 GMT

This is not currently possible, unfortunately. But I will try to implement it in the next version of the tool.

re: New tool: ModuleRescue

J. Bohl — Thu, 18 May 2006 10:20:26 GMT

This is a fantastic tool! Great job!

Is it possible to run this tool on all DLLs in a minidump? Or can it be run from the commandline, something like:
modrescue [minidump] [dllname] [filename_for_dll_to_write]

This would load the [minidump] and write out the "fake-DLL" for [dllname] to the file [filename_for_dll_to_write].

re: New tool: ModuleRescue

Oleg Starodumov — Mon, 01 Aug 2005 09:23:00 GMT

Single stepping (and other "live" debugging actions) are not possible for the modules generated by ModuleRescue.
The modules are only suitable for minidump debugging, because they do not actually contain executable code.
They only contain the information necessary for debuggers to recognize them as executable modules and determine how to obtain/download
symbols (that is, proper PE headers, debug information structures, some other padding).
ModuleRescue does not attempt to reconstruct the real executable code (it is not usually available in minidumps, anyway).

re: New tool: ModuleRescue

Oleg Starodumov — Fri, 29 Jul 2005 15:31:00 GMT

The article sats the debugger can download symbols. But can you perform functions like single stepping thru a program in a recreation scenario.