DumpModule
Create a verified unpacked dump of a loaded module: locate the OEP, rebuild imports, and validate PE/IAT integrity before reporting success.
Instructions
Produce a VERIFIED unpacked dump of a module to disk. With find_oep=True (default) this drives the packer-agnostic OEP engine (FindOEP) — which works for the unpack-in-memory-then-jump class (UPX, ASPack, FSG, MPRESS, PECompact, Petite, simple crypters) — then dumps via Scylla and VERIFIES the result before reporting ok: the entry must have moved out of the packer stub to the real OEP, the IAT must resolve cleanly (no garbage descriptors), and the imports must be non-trivial. A dump that merely landed on disk is NOT a success. On failure it returns ok:false with a reason and keeps the raw memory dump for manual recovery. Virtualizing protectors have no generic recoverable OEP contract here and are reported honestly (isLikelyVirtualized), never faked. The optional virtualization research backend is disabled in this build.
find_oep=False dumps the selected loaded module at the current/module entry. It still performs independent PE/IAT verification by default and never treats mere file creation as success.
Args:
module: Module name to dump (e.g. "target.exe"). Empty = the main
debuggee module.
output_path: Destination path for the dumped file. Empty = a default
path derived from the module.
find_oep: When True (default) find + verify the OEP before dumping;
when False dump from the current state (no verification).
timeout_ms: Budget for OEP discovery (default 30000).
fix_imports: Reconstruct imports with Scylla (default true).
verify: Require independent PE/IAT verification (default true).
overwrite: Explicitly authorize replacing dump artifacts.
keep_raw_dump: Preserve Scylla's pre-IAT raw image.
iat_start/iat_size: Optional exact live IAT range; both are required together.
module_strategy: auto, overlay, or scylla. Auto uses a reloadable
source-backed executable overlay for non-main DLLs.
timeline_path: Optional unpack-workflow-v1 JSON path. When OEP
discovery is enabled and omitted, <output>.workflow.json is
written automatically.
Returns: {"ok": bool, "verified": bool, "path": str, "exists": bool, "size": int, "module": str, "findOep": bool, "oep"?: str, "confidence"?: str, "reason"?: str, "isLikelyVirtualized"?: bool, "rawDumpPath"?: str, "result": ..., "hint"?: str}.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| module | No | ||
| verify | No | ||
| find_oep | No | ||
| iat_size | No | ||
| iat_start | No | ||
| overwrite | No | ||
| timeout_ms | No | ||
| fix_imports | No | ||
| output_path | No | ||
| keep_raw_dump | No | ||
| timeline_path | No | ||
| create_new_iat | No | ||
| module_strategy | No | auto | |
| advanced_iat_search | No |