Lesson plan
Dumper (computer program)
In computer programming, a dumper is a program which copies data from one source (usually a proprietary format) to another (usually in a more easily accessible format). A dumper is a program that saves data from the computer's memory, usually from a foreign process (program) to a (*.dmp) file. Often the process's memory is dumped automatically to disk if the program crashes. You may recover any unsaved data from this file or send it to the developer so he can investigate what caused the crash. Another use of 'dumpers' can be dumping Windows Exe-files from memory after they have been unpacked/decrypted for further analysis (in case of malware), or after unwrapping/unpacking certain security envelopes. These security envelopes are applied by the developer or software vendor to 'protect' these applications. Usually, a security envelope checks if the application has not been modified, if you are still on your evaluation period or if the original CD is inserted before it unpacks and starts the application in memory. However, just dumping is not enough - because structures like the imported API-Call were overwritten or intentionally mangled by the protector at the start and need to be rebuilt to get a running executable.
Article summary
In computer programming, a dumper is a program which copies data from one source (usually a proprietary format) to another (usually in a more easily accessible format). A dumper is a program that saves data from the computer's memory, usually from a foreign process (program) to a (*.dmp) file. Often the process's memory is dumped automatically to disk if the program crashes. You may recover any unsaved data from this file or send it to the developer so he can investigate what caused the crash. Another use of 'dumpers' can be dumping Windows Exe-files from memory after they have been unpacked/decrypted for further analysis (in case of malware), or after unwrapping/unpacking certain security envelopes. These security envelopes are applied by the developer or software vendor to 'protect' these applications. Usually, a security envelope checks if the application has not been modified, if you are still on your evaluation period or if the original CD is inserted before it unpacks and starts the application in memory. However, just dumping is not enough - because structures like the imported API-Call were overwritten or intentionally mangled by the protector at the start and need to be rebuilt to get a running executable.
Key claims
No claims recorded.
Discussion questions
- Summarise the article in your own words. Which single claim would you verify first, and why?
- Which claim in this article is most likely to be revised as the sources update? How would you check its current status?
- If two sources disagreed about one of these facts, what would you need in order to trust one over the other?
Bibliography
No sources recorded.
Key claims and bibliography are generated from the same tracked claims and sources as the article page.