PepiMK
2008-03-13, 12:51
Situation: FileAlyzer analyses the contents of files, with a lot of focus on PE (Portable Executable) files.
Experienced: right now, it only opens files on the harddisk. Analyzing packed files gets complicated, since while FA supports unpacking of UPX and PEC files, there are other packer formats.
Expected: 1.5.7 will allow you to choose a running process to open. This process will get dumped to a file in its current state, and the file will be remapped from virtual to physical offsets to be as much similar to a file stored in the filesystem as possible.