1

I am currently doing byte extraction from PE files using Radare2. I know how to find the byte sequence for Dos Header and PE Header when there is no entry point and the start is defaulted to 0x0. But some of them have an entry point at 0x4#####. I can retrieve the vaddr (virtual address), paddr (physical address), and haddr (e_entry\AddressOfEntryPoint in the binary header) of a certain file with an entry point. How do I use that to find the byte sequence for the Dos Header and PE Header entry point address

0

You can load the file as raw, using -n or -nn option and then you will have those structures available at 0x0.

r2 -n ./open-wsl.exe

enter image description here

It also contains some function to operate and print on those structures in a nicer form. Check the pf? group for more info.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.