Closed blattm closed 2 years ago
The OnlyPeHeaderFilter allows dumping only those tasks which contain a PeHeader. It can be used instead of the OnlyExecutableOrPeHeaderFilter.
OnlyPeHeaderFilter
PeHeader
OnlyExecutableOrPeHeaderFilter
Additionaly an OnlyExecutableOrPeHeaderFilter allows dumping tasks which contain either a PeHeader or an executable memory region.
The OwnPidFilter will exclude the memory of the unpacker itself. Without this filter, e.g. the OnlyPeHeaderFilter can match its own memory.
OwnPidFilter
thx!
The
OnlyPeHeaderFilter
allows dumping only those tasks which contain aPeHeader
. It can be used instead of theOnlyExecutableOrPeHeaderFilter
.Additionaly an
OnlyExecutableOrPeHeaderFilter
allows dumping tasks which contain either a PeHeader or an executable memory region.The
OwnPidFilter
will exclude the memory of the unpacker itself. Without this filter, e.g. theOnlyPeHeaderFilter
can match its own memory.