Extract .text section from PE file only
I am trying to extract a .text section, i.e. code, from a PE file (dll). Is there a simple tool in Linux or some python or ruby lib that allows me to do this easily?
+3
user3207230
source
to share
1 answer
I decided myself. I used the python pefile module where I extracted the text section and used PointerToRawData and VirtualSize to determine where the text section is. Then I used dd to extract the .text section into a separate file.
import pefile
pe = pefile.PE('filepath')
for section in pe.sections:
if section.Name == '.text'
print "%s %s" % (section.PointerToRawData),hex(section.Misc_VirtualSize))
Then dd:
dd if=<lib> of=<lib.text> bs=1 skip=$PointerToRawData count=$VirtualSize
+4
user3207230
source
to share