{
  "added_at": "2026-11-06",
  "additional_evidence_urls": [
    "https://github.com/coconutbird/netdumper/blob/c7ffe79e3afe804868ed61f2d335c4f173d047e3/Cargo.toml"
  ],
  "category": "dotnet",
  "description_en": "netdumper extracts loaded .NET assemblies from Windows processes through the CLR Data Access Component. It enumerates AppDomains and assemblies, recovers JIT method IL, converts memory layouts to PE files, and repairs damaged PE headers or metadata streams for subsequent inspection.",
  "description_zh": "netdumper 通过 CLR Data Access Component 从 Windows 进程中提取已加载的 .NET 程序集。它枚举 AppDomain 与程序集，恢复 JIT 方法的 IL，将内存布局转换为 PE 文件，并修复受损的 PE 头或元数据流以供分析。",
  "entry_url": "https://awesomerea.org/resources/netdumper/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/netdumper/",
  "evidence_url": "https://github.com/coconutbird/netdumper/blob/c7ffe79e3afe804868ed61f2d335c4f173d047e3/README.md",
  "group": "tools",
  "id": "netdumper",
  "json_url": "https://awesomerea.org/resources/netdumper/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/netdumper/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/netdumper/index.md",
  "name": "netdumper",
  "name_zh": "netdumper .NET 程序集内存提取工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirement_facets": [
    "prerequisites",
    "limits",
    "license"
  ],
  "requirements": [
    "Windows, Rust nightly, and the same architecture as the target process are required.",
    "Administrator privileges may be required for some processes.",
    "MIT License."
  ],
  "requirements_zh": [
    "需要 Windows、Rust nightly，且工具架构须与目标进程一致。",
    "分析部分进程可能需要管理员权限。",
    "采用 MIT 许可证。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/coconutbird/netdumper",
  "verification": "source-reviewed",
  "verified_at": "2026-11-06"
}