# netdumper

> netdumper extracts loaded .NET assemblies from Windows processes through the CLR Data Access Component. It enumerates AppDomains and assemblies, recovers JIT method IL, converts memory layouts to PE files, and repairs damaged PE headers or metadata streams for subsequent inspection.

- Type: Tool
- Targets: Binary
- Category: .NET tools
- Relationship: Foundation tool
- Sources reviewed: 2026-11-06
- Added to the catalog: 2026-11-06
- Original resource: <https://github.com/coconutbird/netdumper>
- Primary source: <https://github.com/coconutbird/netdumper/blob/c7ffe79e3afe804868ed61f2d335c4f173d047e3/README.md>
- Catalog page: <https://awesomerea.org/resources/netdumper/>
- Record JSON: <https://awesomerea.org/resources/netdumper/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/netdumper/index.md)

## Requirements & limits

- **Prerequisites:** Windows, Rust nightly, and the same architecture as the target process are required.
- **Limits:** Administrator privileges may be required for some processes.
- **License:** MIT License.

## Primary sources

1. <https://github.com/coconutbird/netdumper/blob/c7ffe79e3afe804868ed61f2d335c4f173d047e3/README.md>
2. <https://github.com/coconutbird/netdumper/blob/c7ffe79e3afe804868ed61f2d335c4f173d047e3/Cargo.toml>

## More in Apps

- [Sandwitcher](https://awesomerea.org/resources/sandwitcher/index.md) · Tool
- [Zygisk - Frida Gadget](https://awesomerea.org/resources/zygisk-fridagadget/index.md) · Tool
- [dnlib](https://awesomerea.org/resources/dnlib/index.md) · Tool
- [View8](https://awesomerea.org/resources/view8/index.md) · Tool
- [Soot](https://awesomerea.org/resources/soot/index.md) · Tool
- [DroidLysis](https://awesomerea.org/resources/droidlysis/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.