Skip to content

Commit 4245ee1

Browse files
committed
Add an example of tracing execution
1 parent f7626ea commit 4245ee1

File tree

1 file changed

+10
-1
lines changed

1 file changed

+10
-1
lines changed

README.md

+10-1
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ An easy-to-use library for emulating code in minidump files.
66

77
There is an [introduction video](https://m.youtube.com/watch?v=4Pfu98Xx9Yo) with [OALabs](https://oalabs.openanalysis.net) available!
88

9-
## Example
9+
## Example - calling a function
1010

1111
The example below opens `StringEncryptionFun_x64.dmp` (download a copy [here](https://github.com/mrexodia/dumpulator/releases/download/v0.0.1/StringEncryptionFun_x64.dmp)), allocates some memory and calls the decryption function at `0x140001000` to decrypt the string at `0x140017000`:
1212

@@ -22,6 +22,15 @@ print(f"decrypted: '{decrypted}'")
2222

2323
The `StringEncryptionFun_x64.dmp` is collected at the entry point of the `tests/StringEncryptionFun` example. You can get the compiled binaries for `StringEncryptionFun` [here](https://github.com/mrexodia/dumpulator/releases/download/v0.0.1/StringEncryptionFun.7z)
2424

25+
## Example - tracing execution
26+
27+
```python
28+
from dumpulator import Dumpulator
29+
30+
dp = Dumpulator("StringEncryptionFun_x64.dmp", trace=True)
31+
dp.start(dp.regs.rip)
32+
```
33+
2534
## Collecting the dump
2635

2736
There is a simple [x64dbg](https://github.com/x64dbg/x64dbg) plugin available called [MiniDumpPlugin](https://github.com/mrexodia/MiniDumpPlugin/releases). To create a dump, pause execution and execute the command `MiniDump my.dmp`.

0 commit comments

Comments
 (0)