CODEWITHSUNDEEP
textportable-executable
user3207230
user3207230

Reputation: 597

Extracting .text section only from a PE file

I am trying to extract the .text section, i.e, the code, from a PE file (a dll). Is there any simple tool in Linux or some python or ruby lib that allows me to do this easily?

Upvotes: 4

Views: 3997

Answers (1)

user3207230
user3207230

Reputation: 597

Solved it myself. I used the pefile python module where I extracted the text section and used PointerToRawData and VirtualSize to deduce where the text section was. Then I used dd to extract the .text section to a separate file.

import pefile
pe = pefile.PE('filepath')
for section in pe.sections:
    if section.Name == '.text'
    print "%s %s" % (section.PointerToRawData),hex(section.Misc_VirtualSize))

Then dd:

dd if=<lib> of=<lib.text> bs=1 skip=$PointerToRawData count=$VirtualSize

Upvotes: 6

Related Questions