> ## Documentation Index
> Fetch the complete documentation index at: https://witchking.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Quick Start

> Common dmpHunter commands to get started fast.

## Essential Commands

```bash theme={null}
# 1) One-shot JSON triage: memmap, handles, threads, modules
dmph dump-json process.dmp triage.json

# 2) Memory map filtered to IMAGE regions → CSV
dmph memmap process.dmp --region-type IMAGE --csv mem.csv

# 3) Handles with decoded access, verify PROCESS_SUSPEND_RESUME
dmph handles process.dmp --handle-type Process --verify

# 4) Threads and their stack ranges
dmph threads process.dmp

# 5) Modules + IAT
dmph modules process.dmp --iat

# 6) Strings across committed PRIVATE regions, show likely command lines
dmph strings process.dmp --region-type PRIVATE --committed-only --cmdlines --min-len 5

# 7) YARA streaming scan
dmph scan process.dmp --yara rules.yar --region-type PRIVATE --writable-only

# 8) Per-thread network heuristics
dmph net process.dmp

# 9) Dump a precise VA range
dmph dump process.dmp --start 0x7FF600000000 --end 0x7FF600001FFF --out chunk.bin

# or start + length
dmph dump process.dmp --start 0x0000022DF0000000 --length 65536 --out region.bin
```

## Selectors & Exporters

**Selectors** (supported by several commands):

| Flag | Description |
| - | - |
| `--region-type PRIVATE\|MAPPED\|IMAGE` | Filter by memory region type |
| `--writable-only` | RW / WRCOPY / XRW / XWRCOPY regions |
| `--rwx-only` | PAGE\_EXECUTE\_READWRITE only |
| `--committed-only` | MEM\_COMMIT state only |

**Exporters:**

* `--json out.json` and `--csv out.csv` on `memmap`
* Dedicated: `dump-json`, `dump-csv`


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.