1

I am currently doing byte extraction from PE files using Radare2. I know how to find the byte sequence for DOS Header and PE Header when there is no entry point and the start is defaulted to 0x0. But some of them have an entry point at 0x4#####.

I can retrieve the vaddr (virtual address), paddr (physical address), and haddr (e_entry\AddressOfEntryPoint in the binary header) of a certain file with an entry point.

How do I use that to find the byte sequence for the DOS Header and PE Header?

entry point address

1 Answer 1

1

You can load the file as raw, using -n or -nn option and then you will have those structures available at 0x0.

r2 -n ./open-wsl.exe

enter image description here

It also contains some function to operate and print on those structures in a nicer form. Check the pf? group for more info.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.