0

There are some images hidden somewhere in a PE I have, I can't figure out how to extract them.

This PE is from around 1997 (I think it's 32 bit) and I believe it contains some 3D model renders from the game Shadow Warrior as .PICT files. Using PE Explorer, I was able to see the section headers: [![Headers][1]][1] However, I see no way to actually unpack the data.

Any help would be appreciated

EDIT3: I am now almost certain that all the images are actually stored within this file: https://www.dropbox.com/s/4rmr0e545a8vova/GW_SW.MPL?dl=0 It's a MPL file, which usually doesn't hold images, but looking at file sizes, it seems to be the only likely candidate.

I believe the program is supposed to extract and uncompress some audio and picture from inside this MPL, but I have no idea how to do that myself.

The program only runs under old operating systems, so if there was a way to take the images out of memory as the program was uncompressing, I don't think I can do that here on my newer pc. However, I do have access to a few DLL files that I can extract from the START.EXE.

|improve this question
  • 2
    Did you try Resource Hacker? – bart1e Aug 4 '19 at 11:15
  • You could try using binwalk program. It is a tool for searching embedded file in binaries. Usage : binwalk -e <your file>. NOTE: I am adding as an answer as I don't have enough reputation to comment. – mapper2496 Aug 4 '19 at 13:19
  • Resource hacker is giving me no option to decompile or anything, and it doesn't really seem to recognize the PE as something it can open. It doesn't find anything to show in the resource tree either. – Mowkitty Aug 4 '19 at 18:15
  • I don't know how to use binwalk, it seems to require Python...? Is there any regular EXE version I can use? – Mowkitty Aug 4 '19 at 20:10
  • Tried out binwalker, it really doesn't seem to find anything at all – Mowkitty Aug 5 '19 at 7:29
0

you can't just unpack the data section. This is a binary file. You have to do it with a hex editor and then search for the structure of an image (.pict file).

|improve this answer
  • I've been looking through some documentation, but I can't find any sort of structure for pict files (at least no structure that I'm able to find in the hex of binary file). If I had a generic pict file to look at, I'm sure I could figure it out though. Also, would I be able to sort of copy and paste the entirety of the pict hexadecimal to another file and have it properly work as a .pict? – Mowkitty Aug 5 '19 at 3:03
  • I've found some sample .PICT files, they all seem to start with 00 11 02 FF 0C 00, but I can't find this anywhere in the binary – Mowkitty Aug 5 '19 at 3:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.