I am confused about how to find the original call stack or crash point in the mini dump of DLL/EXE which was protected by vmprotect. Usually the pdb file is useless after protection of PE file, I tried MiniDumpFixer, but it didn’t seem to work for me. Could anyone help me to find a effective way to analyze the dump file? By the way, I have the pdb, map, and original dll file.
I tried MiniDumpFixer, but it didn’t seem to work for me
Why do you think so?
P.S. Please notice that after MiniDumpFixer you have to load the original (unprotected) file for a fixed dump.