> ## Documentation Index
> Fetch the complete documentation index at: https://witchking.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Overview

> Hunt indicators inside Windows mini/full process dumps.

> **dmpHunter** — Hunt indicators inside Windows **mini/full** process dumps: memory maps, handles, threads, modules (+ IAT), strings, sockets↔threads, YARA, and surgical VA-range dumping.

> [!NOTE]
>
> **Current version:** v0.2.0 · [GitHub Repository](https://github.com/tasox/dmpHunter)

## CLI Aliases

| Command | Description |
| - | - |
| `dmph` | Primary CLI |
| `dmpHunter` | Secondary alias |
| `mdr` | Back-compat alias |

## Features

> [card] Mini & Full Dump Support
>
> Unified VA→file mapping from MemoryList, Memory64List, and Thread stacks.

> [card] Memory Map
>
> Decoded protection, start/end VAs, CSV/JSON export.

> [card] Handles
>
> Decoded access masks (process & thread), verify `PROCESS_SUSPEND_RESUME`.

> [card] Threads
>
> TEB and StackStart/StackEnd per thread.

> [card] Modules & IAT
>
> Full import table parsing per module.

> [card] Strings
>
> ASCII + UTF-16LE, VA-range scanning, and command-line heuristics.

> [card] YARA
>
> Streaming scan over selected regions — no huge allocations.

> [card] Network Heuristics
>
> Socket-like handles correlated to threads + endpoint extraction from stacks.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.