Skip to content

t3ssellate/unmapper

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

10 Commits
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Unmapper

An automatic tool for fixing dumped PE files for decompilation. Especially useful in malware analysis.

What does it do?

Unmapper takes a memdump of a PE file that has been loaded to memory, a common case when researching malware loaders. It modifies the PE's headers such that a decompiler, or other static analysis tools, will be able to load the file correctly and without errors.

Usage

$ Unmapper.exe <filename>