How can one extract the appended data of a Portable Executable?

Question

How do you reliably extract appended data in a Portable Executable?

Answer 1

Just to clarify: the appended data - also called overlay - is the part of a PE file that is not covered by the header.

Because of some tricky conditions in the PE file format, it might be difficult to determine in some extreme case, so it's better to rely on a robust library such as pefile.

Here is a simple Python script that relies on pefile to extract the appended data:

import pefile
import sys

filename = sys.argv[1]
with open(filename, "rb") as s:
    r = s.read()

pe = pefile.PE(filename)
offset = pe.get_overlay_data_start_offset()

with open(filename + ".app", "wb") as t:
    t.write(r[offset:])

use with your filename as argument.

---

Personally, I usually do it with Hiew - as Hiew is faster to start than anything else, and also PE-robust:

1. go at appended data start
   1. in Hex or ASM mode, press F8 to view PE header information
   2. Alt+F2 to go at appended data start
2. select until the end
   1. Keypad-* to start selection
   2. Ctrl+End to go at bottom of the file
   3. Keypad-* again to finish selection
3. F2 to write selection to file

Answer 2

It is not that hard to do manually.

1. Find the PE header from the MZ header and determine the location of the section table.

2. Walk the section table, and determine the maximum value of PointerToRawData + SizeOfRawData. (note: these values are subject to alignment using the FileAlignment member of the IMAGE_OPTIONAL_HEADER).

3. Use the determined maximum as the file offset to the overlay data.

Note that some installers/file formats do not actually use this calculation, but they instead have a small trailer at the end of file which points to the beginning of the payload. For example, ZIP file format works like that - that's why a self-extracting ZIP can be extracted irregardless of whether the unpacker stub is PE, DOS MZ, ELF, Mach-O or anything else.