1

My exact question sounds like: Are there any tools for automated resources extraction such as driver or executable to the ready-to-go .sys or .exe/.msi ?

I googled several ways, but they haven't solved my problem.

  • Exescope -- spoilt the output binary
  • 7zip -- produced some rubbish(i.e. I can not figure out how to use it to achieve the goal)
  • Universal Extractor -- same as 7zip

Any tips will be appreciated.

Improve this question
3
  • 1
    angusj.com/resourcehacker – Paul Jul 22 '14 at 12:05
  • @Paul, thank you. Output is sufficent for draft disassembly, but a lot of resources in produced file seems to be cropped. – see ya Jul 22 '14 at 12:43
  • ResourceHacker reads from the RAT (Resource Address Table). So, any PEs you found that have self extracting PE which doesn't reside in the RAT (Excluding talking about obfuscated PEs) will likely to reside in the .data section. I don't know of any tools to automate searching PEs within .data section. This maybe off topic as it's not automated but you could do it yourself by doing doing signature scan on PE or DOS header. Here's a website for signatures within the PE: marcoramilli.blogspot.co.uk/2010/12/windows-pe-header.html – Paul Jul 22 '14 at 14:05
1

There is already a ready made tool which scans for embedded PE within another PE. Download Exeinfo PE and use the ripper option. It will automatically scan and dump any embedded PE within the master file.

However, obviously, the embedded PE should not be compressed or encrypted in any way.

Improve this answer
0
0

pe-carv.py is script can be used to carve out portable executable files from a data stream.

http://hooked-on-mnemonics.blogspot.com/2013/01/pe-carvpy.html

It relies on pefile by Ero Carrera to parse the portable executable file format and calculate the file size. Since the script relies on the portable executable file format, data that is appended to the end of the file (overlay) will not be carved out.

The algorithm of the script is simple. Search for the strings of the MZ header in a data stream, if found read from the address to the end of the file, then pass the buffer to pefile. If no exceptions are thrown by pefile then we have a valid portable executable file. If an error occurs, search for the next MZ header and then start the process again.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.