level 1
If I am correct, while you can get all unpacked pages you still have no way to simply tie their execution of code blocks together. While some unpackers may unpack on itself, some may unpack in random locations and jmp there. Or is the logic there to tie the executions in sequential order?
level 2
Hi u/tnavda! Thanks for your comment!
PageBuster gets all unpacked pages that are ever executed by a target process. All the dumps we gather are 'decorated' with an epoch (i.e. a sequential timestamp). So that, afterwards, we can reconstruct the absolute order of executable code pages. So basically, we could tie the dumps according to their sequential epoch order.
Let me know if it needs any further clarification.