There are some images hidden somewhere in a PE I have, I can't figure out how to extract them.

This PE is from around 1997 (I think it's 32 bit) and I believe it contains some 3D model renders from the game Shadow Warrior as .PICT files. Using PE Explorer, I was able to see the section headers: [![Headers][1]][1] However, I see no way to actually unpack the data.

Any help would be appreciated

EDIT3: I am now almost certain that all the images are actually stored within this file: https://www.dropbox.com/s/4rmr0e545a8vova/GW_SW.MPL?dl=0 It's a MPL file, which usually doesn't hold images, but looking at file sizes, it seems to be the only likely candidate.

I believe the program is supposed to extract and uncompress some audio and picture from inside this MPL, but I have no idea how to do that myself.

The program only runs under old operating systems, so if there was a way to take the images out of memory as the program was uncompressing, I don't think I can do that here on my newer pc. However, I do have access to a few DLL files that I can extract from the START.EXE.

  • 2
    Did you try Resource Hacker?
    – bart1e
    Commented Aug 4, 2019 at 11:15
  • 1
    You could try using binwalk program. It is a tool for searching embedded file in binaries. Usage : binwalk -e <your file>. NOTE: I am adding as an answer as I don't have enough reputation to comment.
    – mapper2496
    Commented Aug 4, 2019 at 13:19
  • Resource hacker is giving me no option to decompile or anything, and it doesn't really seem to recognize the PE as something it can open. It doesn't find anything to show in the resource tree either.
    – Mowkitty
    Commented Aug 4, 2019 at 18:15
  • I don't know how to use binwalk, it seems to require Python...? Is there any regular EXE version I can use?
    – Mowkitty
    Commented Aug 4, 2019 at 20:10
  • Tried out binwalker, it really doesn't seem to find anything at all
    – Mowkitty
    Commented Aug 5, 2019 at 7:29

2 Answers 2


you can't just unpack the data section. This is a binary file. You have to do it with a hex editor and then search for the structure of an image (.pict file).

  • I've been looking through some documentation, but I can't find any sort of structure for pict files (at least no structure that I'm able to find in the hex of binary file). If I had a generic pict file to look at, I'm sure I could figure it out though. Also, would I be able to sort of copy and paste the entirety of the pict hexadecimal to another file and have it properly work as a .pict?
    – Mowkitty
    Commented Aug 5, 2019 at 3:03
  • I've found some sample .PICT files, they all seem to start with 00 11 02 FF 0C 00, but I can't find this anywhere in the binary
    – Mowkitty
    Commented Aug 5, 2019 at 3:59

I know this thread is a bit dated, but have you tried Sleuthkit?https://www.sleuthkit.org/autopsy/

Haven’t used it in year, but it should do the trick.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.