Dotnet
Jasi Native Assembly Dumper v1.2 - Runtime Catcher + Static Resources Scanner
JasiNativeDumper is a command-line tool for capturing native Windows modules as they are loaded at runtime. It works by spawning the target process and polling its loaded module list - so every LoadLibrary call made by the target, including ones made by packers, protectors, or custom loaders, is intercepted...
Description
JasiNativeDumper is a command-line tool for capturing native Windows modules as they are loaded at runtime. It works by spawning the target process and polling its loaded module list - so every LoadLibrary call made by the target, including ones made by packers, protectors, or custom loaders, is intercepted and the raw PE bytes are written to disk.
It also includes a static scanner that inspects any PE file for embedded executables or DLLs hiding inside resources of any type, managed DLLs loaded by a native host are also flagged and an anti-debug module that patches common debugger
detection techniques before running the target.
Useful for reverse engineering packed or protected native applications where the real payload DLL is only extracted and loaded in memory at runtime, protected binary dumped might need PE reconstruction, fixing section raw offsets, rebuilding the import table etc as dumped is raw SizeOfImage byte copy.
Usage:
JasiNativeDumper --static
JasiNativeDumper --target
JasiNativeDumper --attach
JasiNativeDumper --out
JasiNativeDumper --dontskipknown Also dump system/runtime DLLs, by default skip known
Examples:
JasiNativeDumper --static packed.exe --out C:dumps
JasiNativeDumper --target game.exe --out C:dumps
JasiNativeDumper --attach 1234 --out C:dumps
JasiNativeDumper --target app.exe --dontskipknown --out C:dumps
Notes:
-> Use Build x64 for targeting 64-bit processes, build x86 for targeting 32-bit processes.
-> Static scan works regardless of build bitness, one build can scan any PE file.
-> Anti-debug only runs in --target and --attach modes, not in --static mode.
-> Runtime dumps are captured from process memory, means packed or protected targets are dumped in their unpacked/loaded state which is more useful for analysis, binary dumped might need PE reconstruction, fixing section raw offsets, rebuilding the import table etc to be able to run.
-> Also dump .NET assemblies from resources as well as memory if found.
-> You can also run using RunCommand.bat directly!
Changelog:
v1.2 (03/Jun/2026)
- Added SeDebugPrivilege check on attach mode just in case we have the access might need to run as admin, not needed for target mode we already have the handle and neither on static mode
- SanitizeInitData and RestoreBSS now only run in attach mode, target dumps are pre-init state, the loader has already done the right thing, running sanitization was not needed in previous version
- Heap flags patching added to AntiDebug, PEB->ProcessHeap->Flags and ForceFlags are checked by many protectors alongside BeingDebugged, only called in attach mode
- Added EnumResourceLanguagesA to static scanner to dump all resource of every single language PE/DLL present
- Many bugs fixed under the hood