Clever Geek Handbook

Extract .text section from PE file only

I am trying to extract a .text section, i.e. code, from a PE file (dll). Is there a simple tool in Linux or some python or ruby ​​lib that allows me to do this easily?

+3


source to share


1 answer


I decided myself. I used the python pefile module where I extracted the text section and used PointerToRawData and VirtualSize to determine where the text section is. Then I used dd to extract the .text section into a separate file.

import pefile
pe = pefile.PE('filepath')
for section in pe.sections:
    if section.Name == '.text'
    print "%s %s" % (section.PointerToRawData),hex(section.Misc_VirtualSize))


Then dd:

dd if=<lib> of=<lib.text> bs=1 skip=$PointerToRawData count=$VirtualSize
+4


source






More articles:


All Articles