CODEWITHSUNDEEP
portable-executablemalwaremalware-detection
Mridul Sachan
Mridul Sachan

Reputation: 93

how to extract and remove the header of a windows PE (portable executable) file?

I am working on an assignment in packed malware analysis, in which I have to extract i.e. remove the header file of a PE malware and then I have to fragment the data. But I am unable to find out how to read and extract the header of a PE file.

Upvotes: 0

Views: 992

Answers (1)

Pyjong
Pyjong

Reputation: 3197

Sorry for not taking better effort but well.. it is your assignment right? :) 

PIMAGE_DOS_HEADER pDosHeader;
PIMAGE_NT_HEADERS pNtHeaders;

CreateFile("file.exe",...);
ReadFile(..,ptrBuf,...); 

pDosHeader = ptrBuf;
pNtHeaders = (PIMAGE_NT_HEADERS)(((PUCHAR)pDosHeader) + pDosHeader->e_lfanew);

Duh.. did you not pay attention during the class?

Upvotes: 1

Related Questions