IczDump 1.0 User Guide

Program Name
IczDump
Author
Iczelion
Coded in
32-bit assembly language
Email
Iczelion@galaxycorp.com
Web page

http://win32asm.cjb.net
http://www.win32asm.com
http://www.win32asm.net
http://203.157.250.93/win32asm

Copyright notice
This program is a copyrighted freeware. You're free to use it in anyway you like: I cannot guarantee that it's bug-free. Any damage occurred directly or indirectly from the use of this utility is your own responsibility.
You can't sell this program for profit: I intend this utility to be a freeware and it will always be one.
Greets (in no particular order)
hutch--, ytc, __Ice, TTom, CRowmAN, TheSmurf, Secret, Z-Wing, RevSlim, cTT, masta, n0tty, LLama, mcp, virogen, rudeboy, The_Q, Einride, X-Calibre, X-Logic, the_owl, stone, _iceman__,Kanobi, Ates, baneoldman, fresh, josephCo, Bisoux, WarezPup, immoral, justarius,i_magnus, plushmm, ultraschall, all in #win32asm and #cracking4newbies

IczDump (Iczelion's PE Dumper) is yet another in-memory Portable Executable File dumper. However, it's different in subtle ways from other dumpers: it runs in the same process as the target because it's a DLL. Once the DLL is in a process, it has the same privilege as the the target. It can:

Furthermore, it's difficult to detect because it doesn't use win32 debug api or any ring-0 tracer. Just about the only way it can be detected is for the target to scan the whole process for it and if that occurs, we can find ways of avoiding the detection.

What is included in the package?

How to use IczDump

  1. Put IczDump.dll in the same folder as the target app. This step is necessary so that the target app will be able to find/load IczDump.dll with it.
  2. Run IczLoader.dll. You'll be presented with an open file dialog box. Select the app you want to attach IczDump to and press Ok. If all goes well, the app will run and IczDump.dll will be loaded into its process. When IczDump loads, you will notice a blue tray icon in your system tray like this.
                                                                                                                     
  3. You can view the main window of IczDump by double-clicking the tray icon
                                                                                      

    The title bar displays the currently selected module. The default is the main application module but you can change to other modules in the process later

Main

Display all modules in the process, starting from 4MB to 3GB address space. It displays the base addresses and the path of the modules. You can do several things with this list.

Display

This menu is actually one for PE structure editing features. Note that this only affects the memory image of the module: it doesn't modify the disk file. This feature is handy because you can modify the values and actually test their validity before dumping them to disk files.

 

You can modify the PE header signature in this screen. There are two buttons you can press to see further information: FileHeader and OptionalHeader.

Dump

You can dump DOS header, PE header and section table to disk. IczDump uses the values in file header to determine the starting/ending addresses to dump. If the headers were destroyed, you must reload the headers before dumping.

Advance

This feature is more fine-grained than the IAT chain query. You can put in the value of the dword you suspect that it's an import function address and IczDump will try to resolve the address to module/function name.

 

 

 

IczDump can search the whole module for dwords which match the addresses of functions exported by the modules in the process. It displays the full list in the listbox. You can obtain more information by select an entry in the listbox. The module/function name will be displayed.

 

Finally, you can report bugs to me, Iczelion@galaxycorp.com. Your input is important for the future development of this freeware utility.