Skip to content

Latest commit

 

History

History
13 lines (8 loc) · 439 Bytes

README.md

File metadata and controls

13 lines (8 loc) · 439 Bytes

Unmapper

An automatic tool for fixing dumped PE files for decompilation. Especially useful in malware analysis.

What does it do?

Unmapper takes a memdump of a PE file that has been loaded to memory, a common case when researching malware loaders. It modifies the PE's headers such that a decompiler, or other static analysis tools, will be able to load the file correctly and without errors.

Usage

$ Unmapper.exe <filename>