Added Dumper class.

Author: KN4CK3R

Forms/ProcessInfoForm.cs

@@ -152,10 +152,11 @@ private void createClassAtAddressToolStripMenuItem_Click(object sender, EventArg
 
 		private void dumpToolStripMenuItem_Click(object sender, EventArgs e)
 		{
+			bool isModule;
 			string fileName = string.Empty;
 			string initialDirectory = string.Empty;
 			IntPtr address;
-			IntPtr size;
+			int size;
 
 			if (GetToolStripSourceControl(sender) == modulesDataGridView)
 			{
@@ -165,10 +166,11 @@ private void dumpToolStripMenuItem_Click(object sender, EventArgs e)
 					return;
 				}
 
+				isModule = true;
 				fileName = $"{Path.GetFileNameWithoutExtension(module.Name)}_Dumped{Path.GetExtension(module.Name)}";
 				initialDirectory = Path.GetDirectoryName(module.Path);
 				address = module.Start;
-				size = module.Size;
+				size = module.Size.ToInt32();
 			}
 			else
 			{
@@ -178,22 +180,32 @@ private void dumpToolStripMenuItem_Click(object sender, EventArgs e)
 					return;
 				}
 
+				isModule = false;
 				fileName = $"Section_{section.Start.ToString("X")}_{section.End.ToString("X")}.dat";
 				address = section.Start;
-				size = section.Size;
+				size = section.Size.ToInt32();
 			}
 
 			using (var sfd = new SaveFileDialog())
 			{
 				sfd.FileName = fileName;
+				sfd.Filter = "All|*.*";
 				sfd.InitialDirectory = initialDirectory;
 
 				if (sfd.ShowDialog() == DialogResult.OK)
 				{
-					var data = process.ReadRemoteMemory(address, size.ToInt32());
-					using (var bw = new BinaryWriter(sfd.OpenFile()))
+					var dumper = new Dumper(process);
+
+					using (var stream = sfd.OpenFile())
 					{
-						bw.Write(data);
+						if (isModule)
+						{
+							dumper.DumpModule(address, size, stream);
+						}
+						else
+						{
+							dumper.DumpSection(address, size, stream);
+						}
 					}
 				}
 			}

Memory/Dumper.cs

@@ -0,0 +1,80 @@
+using System;
+using System.Diagnostics.Contracts;
+using System.IO;
+
+namespace ReClassNET.Memory
+{
+	public class Dumper
+	{
+		private readonly RemoteProcess process;
+
+		public Dumper(RemoteProcess process)
+		{
+			Contract.Requires(process != null);
+
+			this.process = process;
+		}
+
+		/// <summary>Dumps a section to the given stream.</summary>
+		/// <param name="address">The begin of the section.</param>
+		/// <param name="size">The size of the section.</param>
+		/// <param name="stream">The stream to dump to.</param>
+		public void DumpSection(IntPtr address, int size, Stream stream)
+		{
+			Contract.Requires(stream != null);
+
+			var data = process.ReadRemoteMemory(address, size);
+
+			stream.Write(data, 0, data.Length);
+		}
+
+		/// <summary>Dumps a module to the given stream. The section headers of the pe header get fixed to make a valid pe file.</summary>
+		/// <param name="address">The begin of the module.</param>
+		/// <param name="size">The size of the module.</param>
+		/// <param name="stream">The stream to dump to.</param>
+		public void DumpModule(IntPtr address, int size, Stream stream)
+		{
+			Contract.Requires(stream != null);
+
+			var data = process.ReadRemoteMemory(address, size);
+
+			var pe = new SimplePeHeader(data);
+
+			// Fix the section headers.
+			using (var bw = new BinaryWriter(new MemoryStream(data)))
+			{
+				for (var i = 0; i < pe.NumberOfSections; ++i)
+				{
+					var offset = pe.SectionOffset(i);
+					bw.Seek(offset + 16, SeekOrigin.Begin);
+					bw.Write(BitConverter.ToUInt32(data, offset + 8)); // SizeOfRawData = VirtualSize
+					bw.Write(BitConverter.ToUInt32(data, offset + 12)); // PointerToRawData = VirtualAddress
+				}
+			}
+
+			stream.Write(data, 0, data.Length);
+		}
+
+		private class SimplePeHeader
+		{
+			private readonly byte[] data;
+
+			private int e_lfanew => BitConverter.ToInt32(data, 60);
+
+			private int FileHeader => e_lfanew + 4;
+
+			public int NumberOfSections => BitConverter.ToInt16(data, FileHeader + 2);
+
+			private int SizeOfOptionalHeader => BitConverter.ToInt16(data, FileHeader + 16);
+
+			private int FirstSectionOffset => e_lfanew + 24 + SizeOfOptionalHeader;
+
+			public int SectionOffset(int index) => FirstSectionOffset + index * 40;
+
+			public SimplePeHeader(byte[] data)
+			{
+				this.data = data;
+			}
+		}
+	}
+}

ReClass.NET.csproj

@@ -154,6 +154,7 @@
     </Compile>
     <Compile Include="Memory\Module.cs" />
     <Compile Include="Memory\NodeDissector.cs" />
+    <Compile Include="Memory\Dumper.cs" />
     <Compile Include="Memory\Section.cs" />
     <Compile Include="Memory\UnionDataType.cs" />
     <Compile Include="Nodes\BoolNode.cs" />