I'm trying to decrypt Unity games that are encrypted, but it have anti-ptrace which means i can't create core dump from the memory inside Android emulator and the game crash if i try to attach to cloned dump.So i think the only way to grab the decrypted file is from an Android Emulator called Nox Player. The decrypted .dll files are temporary stored in the memory when the game loads. I see in Task Manager that the memory size increses after i launched the game. I used Microsoft's ProcDump v8.2 to create full dump from the memory using procdump.exe -ma xxxx, recover .dll files using WinHEX and load all .dll in .NET Reflector but none of dll are .NET module.I created my own C# program that temporary store .wav file in the memory and i was able to recover it using ProcDump, so it's not ProcDump problem.Is there other way to create a core dump that also dumps temporary stored plain files? or is it not possible due to virtual machine/emulator encryption?
Dump memory from an Android emulator on Windows
android;dumping;virtual machines;memory dump