-1

I would like to dump the .text section on MS Windows .exe PE files in Ubuntu 14.04.4.

I install pedump, on my Ubuntu system using

sudo apt-get install mono-utils

When I tried running

pedump code /full/path/prefix.exe

I got the message

Cannot open image  /full/path/prefix.exe

When I tried

pedump --verify error /full/path/prefix.exe

I got

Error: Invalid PE header machine value.

With another file, I got the following

pedump code /full/path/prefix2.exe
Cannot open image  /full/path/prefix2.exe
pedump --verify error /full/path/prefix2.exe
Error: Invalid section alignment 1000

Would these problems be due to trying to read MS Windows files on a Ubuntu system? Is there a better tool I could use to dump the .text section of MS Windows PE files on a Ubuntu system?

  • Have you tried pedump code ./prefix.exe? – Jason Geffner Apr 27 '16 at 21:51
  • Yes. I tried that and the full path name. However, that is a good point. I have edited my question to reflect that. Thanks, – OtagoHarbour Apr 27 '16 at 22:12
1

pedump from Mono utils is a software that does only work with .net assemblies. You can't use it to dump standard executables:

$ pedump /software/Windows/PortableInstalled/NavPaneCustomizer/Windows\ 7\ Navigation\ Pane\ Customizer.exe |head

COFF Header:
                    Machine: 0x014c
                   Sections: 0x0003
                 Time stamp: 0x4d63c52b
    Pointer to Symbol Table: 0x00000000
           Symbol Count: 0x00000000
       Optional Header Size: 0x00e0
        Characteristics: 0x0102
   ....

but

$ pedump /software/Windows/PortableInstalled/wxHexEditor/wxHexEditor.exe 
Cannot open image /software/Windows/PortableInstalled/wxHexEditor/wxHexEditor.exe
$ ls -l /software/Windows/PortableInstalled/wxHexEditor/wxHexEditor.exe 
-rw-r--r-- 1 gbl users 1565696 Mai  9  2013 /software/Windows/PortableInstalled/wxHexEditor/wxHexEditor.exe

(the ls output shows you it's not an access rights problem)

There is a different software at https://github.com/zed-0xff/pedump that's named pedump as well, but these two have nothing to do with each other. You can proably use the online version at http://pedump.me/ if this is a once-only project, and you don't want to go through the hassle of getting a ruby environment working on your system.

If you want to use a local program, objdump works fine even for Windows PE executables:

$ objdump -d /software/Windows/PortableInstalled/wxHexEditor/wxHexEditor.exe 

/software/Windows/PortableInstalled/wxHexEditor/wxHexEditor.exe:     Dateiformat pei-i386


Disassembly of section UPX0:

00401000 <UPX0>:
  401000:   10 1a                   adc    %bl,(%edx)
  401002:   71 53                   jno    0x401057
  401004:   80 67 17 4b             andb   $0x4b,0x17(%edi)
  401008:   00 3c 3b                add    %bh,(%ebx,%edi,1)
  40100b:   16                      push   %ss
  40100c:   00 00                   add    %al,(%eax)
  40100e:   ec                      in     (%dx),%al
  40100f:   47                      inc    %edi
  ....

(wxHexEditor is probably a bad example, as it's UPX-packed, but i have very few windows programs available on my Linux box right now)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.