How in IDA can save memory dump with command or script?

Question

1. IDA, Hex-View
2. I select with mouse zone of bytes from StartAddress to EndAddress
3. Right Click -> Save to File
4. Got memory dump.

How do the same with command?Like: SaveDump(StartAddress , EndAddress) SaveDump(0x00001000 , 0x00002000)

Answer 1

yes that works, but it's very slow writing a single byte at a time. try this for instant dumping:

auto fname      = "C:\\dump_mem.bin";
auto address    = 0x0400000;
auto size       = 0x0300000;
auto file= fopen(fname, "wb");

savefile(file, 0, address, size);
fclose(file);

Answer 2

Using the IDA Python API, you can save off a region of memory using the following script, which will prompt you to specify where the resulting file should be saved:

filename = AskFile(1, "*.bin", "Output file name")
address = 0x009DD5B8
size = 0x37a0
dbgr = False
with open(filename, "wb") as out:
    data = GetManyBytes(address, size, use_dbg=dbgr)
    out.write(data)

If you want to save off the bytes corresponding to a memory region that you've highlighted in the graphical interface, you can use the following in the script above:

address = idc.read_selection_start()
if address == idc.BADADDR:
    raise Exception("No memory region selected")
size = idc.read_selection_end() - address

Set dbgr to True if the script is run during a debugger session.