Combat Arms Module Dumper v2

[[MPGH]master131]

Combat Arms Module Dumper v2

Combat Arms Module Dumper is a tool designed to make dumping of modules (such as Engine.exe and CShell.dll) quick and easy, coded entirely in C#. It works on 64-bit OSes unlike other alternatives such as Kernel Detective that require a driver to operate. I've tested it on Combat Arms NA however I'm guessing it'd work on EU (and other countries) as well.



Features:
- Fully user-mode, no drivers used.
- No DLL injection required.
- Works when the game is in fullscreen and when HackShield has hidden the game.
- IAT/Imports reconstruction.
- Removes bad sections from Themida protection.

Instructions:
- Start Combat Arms or Combat Arms Module Dumper, does not matter which order (still works when game is in fullscreen)
- Hit Refresh if you started the tool first (should be over 100 modules or so)
- Select the module to dump and click Dump

Notes:
- You may notice Task Manager opening, please do not close it while the tool is "Waiting for Combat Arms" because it needs it to work.
- The dumper still works when the game is in fullscreen mode where most tools can't access the game.
- This version produces proper EXEs or DLLs, it doesn't do memory dumps anymore.
- If you get a message saying "Unable to communicate with/start Task Manager, the program will now close." try starting the dumper again while Task Manager is already open.

I've only fully tested on Windows 8.1 x64 and a little on XP x86 but hopefully it works on everything else.

Virus Scans:
https://virusscan.jotti.org/en/scanre...8a8f9f99dfbd31
https://www.virustotal.com/en/file/d...a296/analysis/

Please ignore the false positives, it's not a trojan.

[Fєηix]

Good Work

[diegosarria12]

Good job friend

[Timboy67678]

This is a really handy tool, good release (Y)

[maddoggy00]

Must be a virus. Approved anyway.

[Tayp.Anonymous]

Good work will help many!

[COD3RIN]

Awesome master131 rep i'll test this later in other game

[J]

[XarutoUsoCrack]

well, at we can see, this dumper is like PETools in x64....

[[MPGH]master131]

It's not designed to be run by a debugger.... You need to use a disassembler like IDA. For some reason the dumps aren't runnable or debuggable, I need to figure out why.

EDIT - Looks like I forgot to fix some values in the PE header, I'll make an update soon.