pedump 0.5.2 → 0.6.2
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +5 -5
- data/.github/workflows/rubocop-analysis.yml +39 -0
- data/CODE_OF_CONDUCT.md +76 -0
- data/Gemfile +14 -1
- data/Gemfile.lock +78 -31
- data/README.md +111 -16
- data/Rakefile +71 -6
- data/VERSION +1 -1
- data/data/comp_id.txt +776 -0
- data/lib/pedump.rb +120 -29
- data/lib/pedump/cli.rb +150 -37
- data/lib/pedump/loader.rb +28 -6
- data/lib/pedump/loader/minidump.rb +130 -15
- data/lib/pedump/loader/section.rb +5 -3
- data/lib/pedump/ne.rb +1 -1
- data/lib/pedump/pe.rb +63 -54
- data/lib/pedump/rich.rb +562 -0
- data/lib/pedump/te.rb +62 -0
- data/lib/pedump/unpacker/aspack.rb +1 -1
- data/lib/pedump/version.rb +2 -5
- data/misc/aspack/aspack_unlzx.c +5 -3
- data/pedump.gemspec +96 -28
- metadata +49 -30
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
|
-
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
2
|
+
SHA256:
|
|
3
|
+
metadata.gz: 9d4f9c13c95df2d30baf18bba07765fa26f1d4066a8abde228cba5cd29bc9df0
|
|
4
|
+
data.tar.gz: b034a68704793f502843db9ec791ca636e404b20258ae144a349e718eaf8a6b6
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 5b3187809523a111b8cf6ed608047f19044a4e616591297991ae6f97aabd7a783113b8cbf1c1a04d7968cbff6baa5f188c2aec504540ca305117fa38e7c61273
|
|
7
|
+
data.tar.gz: b870e93e3cc90785836ed6719599f855e20c026489bec925d4859e493f4c3a65b1b7c60ca15a8040f8be652ed1884171b302009c2ed5a16d6a3887b2d00ed36c
|
|
@@ -0,0 +1,39 @@
|
|
|
1
|
+
name: "Rubocop"
|
|
2
|
+
|
|
3
|
+
on: push
|
|
4
|
+
|
|
5
|
+
jobs:
|
|
6
|
+
rubocop:
|
|
7
|
+
runs-on: ubuntu-latest
|
|
8
|
+
strategy:
|
|
9
|
+
fail-fast: false
|
|
10
|
+
|
|
11
|
+
steps:
|
|
12
|
+
- name: Checkout repository
|
|
13
|
+
uses: actions/checkout@v2
|
|
14
|
+
|
|
15
|
+
# If running on a self-hosted runner, check it meets the requirements
|
|
16
|
+
# listed at https://github.com/ruby/setup-ruby#using-self-hosted-runners
|
|
17
|
+
- name: Set up Ruby
|
|
18
|
+
uses: ruby/setup-ruby@v1
|
|
19
|
+
with:
|
|
20
|
+
ruby-version: 2.6
|
|
21
|
+
|
|
22
|
+
# This step is not necessary if you add the gem to your Gemfile
|
|
23
|
+
- name: Install Code Scanning integration
|
|
24
|
+
run: bundle add code-scanning-rubocop --version 0.3.0 --skip-install
|
|
25
|
+
|
|
26
|
+
- name: Install dependencies
|
|
27
|
+
run: bundle install
|
|
28
|
+
|
|
29
|
+
- name: Rubocop run
|
|
30
|
+
run: |
|
|
31
|
+
bash -c "
|
|
32
|
+
bundle exec rubocop --require code_scanning --format CodeScanning::SarifFormatter -o rubocop.sarif
|
|
33
|
+
[[ $? -ne 2 ]]
|
|
34
|
+
"
|
|
35
|
+
|
|
36
|
+
- name: Upload Sarif output
|
|
37
|
+
uses: github/codeql-action/upload-sarif@v1
|
|
38
|
+
with:
|
|
39
|
+
sarif_file: rubocop.sarif
|
data/CODE_OF_CONDUCT.md
ADDED
|
@@ -0,0 +1,76 @@
|
|
|
1
|
+
# Contributor Covenant Code of Conduct
|
|
2
|
+
|
|
3
|
+
## Our Pledge
|
|
4
|
+
|
|
5
|
+
In the interest of fostering an open and welcoming environment, we as
|
|
6
|
+
contributors and maintainers pledge to making participation in our project and
|
|
7
|
+
our community a harassment-free experience for everyone, regardless of age, body
|
|
8
|
+
size, disability, ethnicity, sex characteristics, gender identity and expression,
|
|
9
|
+
level of experience, education, socio-economic status, nationality, personal
|
|
10
|
+
appearance, race, religion, or sexual identity and orientation.
|
|
11
|
+
|
|
12
|
+
## Our Standards
|
|
13
|
+
|
|
14
|
+
Examples of behavior that contributes to creating a positive environment
|
|
15
|
+
include:
|
|
16
|
+
|
|
17
|
+
* Using welcoming and inclusive language
|
|
18
|
+
* Being respectful of differing viewpoints and experiences
|
|
19
|
+
* Gracefully accepting constructive criticism
|
|
20
|
+
* Focusing on what is best for the community
|
|
21
|
+
* Showing empathy towards other community members
|
|
22
|
+
|
|
23
|
+
Examples of unacceptable behavior by participants include:
|
|
24
|
+
|
|
25
|
+
* The use of sexualized language or imagery and unwelcome sexual attention or
|
|
26
|
+
advances
|
|
27
|
+
* Trolling, insulting/derogatory comments, and personal or political attacks
|
|
28
|
+
* Public or private harassment
|
|
29
|
+
* Publishing others' private information, such as a physical or electronic
|
|
30
|
+
address, without explicit permission
|
|
31
|
+
* Other conduct which could reasonably be considered inappropriate in a
|
|
32
|
+
professional setting
|
|
33
|
+
|
|
34
|
+
## Our Responsibilities
|
|
35
|
+
|
|
36
|
+
Project maintainers are responsible for clarifying the standards of acceptable
|
|
37
|
+
behavior and are expected to take appropriate and fair corrective action in
|
|
38
|
+
response to any instances of unacceptable behavior.
|
|
39
|
+
|
|
40
|
+
Project maintainers have the right and responsibility to remove, edit, or
|
|
41
|
+
reject comments, commits, code, wiki edits, issues, and other contributions
|
|
42
|
+
that are not aligned to this Code of Conduct, or to ban temporarily or
|
|
43
|
+
permanently any contributor for other behaviors that they deem inappropriate,
|
|
44
|
+
threatening, offensive, or harmful.
|
|
45
|
+
|
|
46
|
+
## Scope
|
|
47
|
+
|
|
48
|
+
This Code of Conduct applies both within project spaces and in public spaces
|
|
49
|
+
when an individual is representing the project or its community. Examples of
|
|
50
|
+
representing a project or community include using an official project e-mail
|
|
51
|
+
address, posting via an official social media account, or acting as an appointed
|
|
52
|
+
representative at an online or offline event. Representation of a project may be
|
|
53
|
+
further defined and clarified by project maintainers.
|
|
54
|
+
|
|
55
|
+
## Enforcement
|
|
56
|
+
|
|
57
|
+
Instances of abusive, harassing, or otherwise unacceptable behavior may be
|
|
58
|
+
reported by contacting the project team at zed.0xff@gmail.com. All
|
|
59
|
+
complaints will be reviewed and investigated and will result in a response that
|
|
60
|
+
is deemed necessary and appropriate to the circumstances. The project team is
|
|
61
|
+
obligated to maintain confidentiality with regard to the reporter of an incident.
|
|
62
|
+
Further details of specific enforcement policies may be posted separately.
|
|
63
|
+
|
|
64
|
+
Project maintainers who do not follow or enforce the Code of Conduct in good
|
|
65
|
+
faith may face temporary or permanent repercussions as determined by other
|
|
66
|
+
members of the project's leadership.
|
|
67
|
+
|
|
68
|
+
## Attribution
|
|
69
|
+
|
|
70
|
+
This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
|
|
71
|
+
available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
|
|
72
|
+
|
|
73
|
+
[homepage]: https://www.contributor-covenant.org
|
|
74
|
+
|
|
75
|
+
For answers to common questions about this code of conduct, see
|
|
76
|
+
https://www.contributor-covenant.org/faq
|
data/Gemfile
CHANGED
|
@@ -1,2 +1,15 @@
|
|
|
1
1
|
source "https://rubygems.org"
|
|
2
|
-
gemspec
|
|
2
|
+
#gemspec
|
|
3
|
+
|
|
4
|
+
gem 'rainbow'
|
|
5
|
+
gem "awesome_print"
|
|
6
|
+
gem "iostruct", ">= 0.0.4"
|
|
7
|
+
gem "multipart-post", ">= 2.0.0"
|
|
8
|
+
gem "zhexdump", ">= 0.0.2"
|
|
9
|
+
|
|
10
|
+
group :development do
|
|
11
|
+
gem "rspec", "~> 3.9.0"
|
|
12
|
+
gem "rspec-its", "~> 1.3.0"
|
|
13
|
+
gem "bundler", "~> 2.2.3"
|
|
14
|
+
gem "jeweler", "~> 2.3.9"
|
|
15
|
+
end
|
data/Gemfile.lock
CHANGED
|
@@ -1,45 +1,92 @@
|
|
|
1
|
-
PATH
|
|
2
|
-
remote: .
|
|
3
|
-
specs:
|
|
4
|
-
pedump (0.5.1)
|
|
5
|
-
awesome_print
|
|
6
|
-
iostruct (>= 0.0.4)
|
|
7
|
-
multipart-post (~> 2.0.0)
|
|
8
|
-
progressbar
|
|
9
|
-
zhexdump (>= 0.0.2)
|
|
10
|
-
|
|
11
1
|
GEM
|
|
12
2
|
remote: https://rubygems.org/
|
|
13
3
|
specs:
|
|
14
|
-
|
|
15
|
-
|
|
4
|
+
addressable (2.4.0)
|
|
5
|
+
awesome_print (1.8.0)
|
|
6
|
+
builder (3.2.4)
|
|
7
|
+
descendants_tracker (0.0.4)
|
|
8
|
+
thread_safe (~> 0.3, >= 0.3.1)
|
|
9
|
+
diff-lcs (1.4.4)
|
|
10
|
+
faraday (0.9.2)
|
|
11
|
+
multipart-post (>= 1.2, < 3)
|
|
12
|
+
git (1.8.1)
|
|
13
|
+
rchardet (~> 1.8)
|
|
14
|
+
github_api (0.16.0)
|
|
15
|
+
addressable (~> 2.4.0)
|
|
16
|
+
descendants_tracker (~> 0.0.4)
|
|
17
|
+
faraday (~> 0.8, < 0.10)
|
|
18
|
+
hashie (>= 3.4)
|
|
19
|
+
mime-types (>= 1.16, < 3.0)
|
|
20
|
+
oauth2 (~> 1.0)
|
|
21
|
+
hashie (4.1.0)
|
|
22
|
+
highline (2.0.3)
|
|
16
23
|
iostruct (0.0.4)
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
24
|
+
jeweler (2.3.9)
|
|
25
|
+
builder
|
|
26
|
+
bundler
|
|
27
|
+
git (>= 1.2.5)
|
|
28
|
+
github_api (~> 0.16.0)
|
|
29
|
+
highline (>= 1.6.15)
|
|
30
|
+
nokogiri (>= 1.5.10)
|
|
31
|
+
psych
|
|
32
|
+
rake
|
|
33
|
+
rdoc
|
|
34
|
+
semver2
|
|
35
|
+
jwt (2.2.2)
|
|
36
|
+
mime-types (2.99.3)
|
|
37
|
+
mini_portile2 (2.5.0)
|
|
38
|
+
multi_json (1.15.0)
|
|
39
|
+
multi_xml (0.6.0)
|
|
40
|
+
multipart-post (2.1.1)
|
|
41
|
+
nokogiri (1.11.1)
|
|
42
|
+
mini_portile2 (~> 2.5.0)
|
|
43
|
+
racc (~> 1.4)
|
|
44
|
+
oauth2 (1.4.4)
|
|
45
|
+
faraday (>= 0.8, < 2.0)
|
|
46
|
+
jwt (>= 1.0, < 3.0)
|
|
47
|
+
multi_json (~> 1.3)
|
|
48
|
+
multi_xml (~> 0.5)
|
|
49
|
+
rack (>= 1.2, < 3)
|
|
50
|
+
psych (3.3.0)
|
|
51
|
+
racc (1.5.2)
|
|
52
|
+
rack (2.2.3)
|
|
53
|
+
rainbow (3.0.0)
|
|
54
|
+
rake (13.0.3)
|
|
55
|
+
rchardet (1.8.0)
|
|
56
|
+
rdoc (6.3.0)
|
|
57
|
+
rspec (3.9.0)
|
|
58
|
+
rspec-core (~> 3.9.0)
|
|
59
|
+
rspec-expectations (~> 3.9.0)
|
|
60
|
+
rspec-mocks (~> 3.9.0)
|
|
61
|
+
rspec-core (3.9.3)
|
|
62
|
+
rspec-support (~> 3.9.3)
|
|
63
|
+
rspec-expectations (3.9.4)
|
|
27
64
|
diff-lcs (>= 1.2.0, < 2.0)
|
|
28
|
-
rspec-support (~> 3.
|
|
29
|
-
rspec-
|
|
65
|
+
rspec-support (~> 3.9.0)
|
|
66
|
+
rspec-its (1.3.0)
|
|
67
|
+
rspec-core (>= 3.0.0)
|
|
68
|
+
rspec-expectations (>= 3.0.0)
|
|
69
|
+
rspec-mocks (3.9.1)
|
|
30
70
|
diff-lcs (>= 1.2.0, < 2.0)
|
|
31
|
-
rspec-support (~> 3.
|
|
32
|
-
rspec-support (3.
|
|
71
|
+
rspec-support (~> 3.9.0)
|
|
72
|
+
rspec-support (3.9.4)
|
|
73
|
+
semver2 (3.4.2)
|
|
74
|
+
thread_safe (0.3.6)
|
|
33
75
|
zhexdump (0.0.2)
|
|
34
76
|
|
|
35
77
|
PLATFORMS
|
|
36
78
|
ruby
|
|
37
79
|
|
|
38
80
|
DEPENDENCIES
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
81
|
+
awesome_print
|
|
82
|
+
bundler (~> 2.2.3)
|
|
83
|
+
iostruct (>= 0.0.4)
|
|
84
|
+
jeweler (~> 2.3.9)
|
|
85
|
+
multipart-post (>= 2.0.0)
|
|
86
|
+
rainbow
|
|
87
|
+
rspec (~> 3.9.0)
|
|
88
|
+
rspec-its (~> 1.3.0)
|
|
89
|
+
zhexdump (>= 0.0.2)
|
|
43
90
|
|
|
44
91
|
BUNDLED WITH
|
|
45
|
-
|
|
92
|
+
2.2.3
|
data/README.md
CHANGED
|
@@ -1,6 +1,17 @@
|
|
|
1
|
-
pedump [](https://travis-ci.org/zed-0xff/pedump) [](https://travis-ci.org/zed-0xff/pedump) [](https://ko-fi.com/K3K81Z3W5)
|
|
2
2
|
======
|
|
3
3
|
|
|
4
|
+
News
|
|
5
|
+
----
|
|
6
|
+
```
|
|
7
|
+
2021.02.18 - updated gems; changed open-uri to URI.open; enabled SSL on https://pedump.me/
|
|
8
|
+
2020.08.09 - CLI: added resource extracting with --extract ID
|
|
9
|
+
2020.07.28 - 0.6.1; better RICH HDR parsing/output
|
|
10
|
+
2020.07.27 - 0.6.0
|
|
11
|
+
2020.07.26 - now travis autotests run on ARM and OSX too!
|
|
12
|
+
2020.07.25 - added EFI TE parsing; removed 'progressbar' gem dependency
|
|
13
|
+
```
|
|
14
|
+
|
|
4
15
|
Description
|
|
5
16
|
-----------
|
|
6
17
|
A pure ruby implementation of win32 PE binary files dumper.
|
|
@@ -11,6 +22,7 @@ Supported formats:
|
|
|
11
22
|
* win16 NE
|
|
12
23
|
* win32 PE
|
|
13
24
|
* win64 PE
|
|
25
|
+
* EFI TE
|
|
14
26
|
|
|
15
27
|
Can dump:
|
|
16
28
|
|
|
@@ -24,7 +36,7 @@ Can dump:
|
|
|
24
36
|
* Imports & Exports
|
|
25
37
|
* VS_VERSIONINFO parsing
|
|
26
38
|
* PE Packer/Compiler detection
|
|
27
|
-
* a convenient way to upload your PE's to
|
|
39
|
+
* a convenient way to upload your PE's to https://pedump.me for a nice HTML tables with image previews, candies & stuff
|
|
28
40
|
|
|
29
41
|
Installation
|
|
30
42
|
------------
|
|
@@ -43,13 +55,14 @@ Usage
|
|
|
43
55
|
(can be used multiple times)
|
|
44
56
|
-F, --force Try to dump by all means
|
|
45
57
|
(can cause exceptions & heavy wounds)
|
|
46
|
-
-f, --format FORMAT Output format: bin,c,dump,hex,inspect,table,yaml
|
|
58
|
+
-f, --format FORMAT Output format: bin,c,dump,hex,inspect,json,table,yaml
|
|
47
59
|
(default: table)
|
|
48
60
|
--mz
|
|
49
61
|
--dos-stub
|
|
50
62
|
--rich
|
|
51
63
|
--pe
|
|
52
64
|
--ne
|
|
65
|
+
--te
|
|
53
66
|
--data-directory
|
|
54
67
|
-S, --sections
|
|
55
68
|
--tls
|
|
@@ -66,10 +79,20 @@ Usage
|
|
|
66
79
|
mimics 'file' command output
|
|
67
80
|
-r, --recursive recurse dirs in packer detect
|
|
68
81
|
--all Dump all but resource-directory (default)
|
|
82
|
+
|
|
83
|
+
--extract ID Extract a resource/section/data_dir
|
|
84
|
+
ID: datadir:EXPORT - datadir by type
|
|
85
|
+
ID: resource:0x98478 - resource by offset
|
|
86
|
+
ID: resource:ICON/#1 - resource by type & name
|
|
87
|
+
ID: section:.text - section by name
|
|
88
|
+
ID: section:rva/0x1000 - section by RVA
|
|
89
|
+
ID: section:raw/0x400 - section by RAW_PTR
|
|
69
90
|
--va2file VA Convert RVA to file offset
|
|
70
|
-
|
|
91
|
+
|
|
92
|
+
-W, --web Uploads files to a https://pedump.me
|
|
71
93
|
for a nice HTML tables with image previews,
|
|
72
94
|
candies & stuff
|
|
95
|
+
-C, --console opens IRB console with specified file loaded
|
|
73
96
|
|
|
74
97
|
### MZ Header
|
|
75
98
|
|
|
@@ -107,10 +130,10 @@ Usage
|
|
|
107
130
|
|
|
108
131
|
=== DOS STUB ===
|
|
109
132
|
|
|
110
|
-
00000000:
|
|
111
|
-
00000010:
|
|
112
|
-
00000020:
|
|
113
|
-
00000030:
|
|
133
|
+
00000000: 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 |........!..L.!Th|
|
|
134
|
+
00000010: 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f |is program canno|
|
|
135
|
+
00000020: 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 |t be run in DOS |
|
|
136
|
+
00000030: 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 |mode....$.......|
|
|
114
137
|
|
|
115
138
|
### 'Rich' Header
|
|
116
139
|
|
|
@@ -118,14 +141,14 @@ Usage
|
|
|
118
141
|
|
|
119
142
|
=== RICH Header ===
|
|
120
143
|
|
|
121
|
-
|
|
122
|
-
|
|
123
|
-
|
|
124
|
-
|
|
125
|
-
|
|
126
|
-
|
|
127
|
-
|
|
128
|
-
|
|
144
|
+
ID VER COUNT DESCRIPTION
|
|
145
|
+
95 521e 9 [ASM] VS2008 build 21022
|
|
146
|
+
1 0 367 [---] Unmarked objects
|
|
147
|
+
93 521e 29 [IMP] VS2008 build 21022
|
|
148
|
+
84 521e 129 [C++] VS2008 build 21022
|
|
149
|
+
83 521e 25 [ C ] VS2008 build 21022
|
|
150
|
+
94 521e 1 [RES] VS2008 build 21022
|
|
151
|
+
91 521e 1 [LNK] VS2008 build 21022
|
|
129
152
|
|
|
130
153
|
### PE Header
|
|
131
154
|
|
|
@@ -405,6 +428,78 @@ Usage
|
|
|
405
428
|
samples/unpackme.exe: ASProtect 1.33 - 2.1 Registered (Alexey Solodovnikov)
|
|
406
429
|
samples/zlib.dll: Microsoft Visual C v2.0
|
|
407
430
|
|
|
431
|
+
### Extracting
|
|
432
|
+
|
|
433
|
+
#### Resources
|
|
434
|
+
|
|
435
|
+
by name:
|
|
436
|
+
|
|
437
|
+
# pedump calc.exe --extract resource:VERSION/#1 | hexdump -C | head
|
|
438
|
+
|
|
439
|
+
00000000 78 03 34 00 00 00 56 00 53 00 5f 00 56 00 45 00 |x.4...V.S._.V.E.|
|
|
440
|
+
00000010 52 00 53 00 49 00 4f 00 4e 00 5f 00 49 00 4e 00 |R.S.I.O.N._.I.N.|
|
|
441
|
+
00000020 46 00 4f 00 00 00 00 00 bd 04 ef fe 00 00 01 00 |F.O.............|
|
|
442
|
+
00000030 01 00 06 00 00 00 91 1a 01 00 06 00 00 00 91 1a |................|
|
|
443
|
+
00000040 3f 00 00 00 00 00 00 00 04 00 04 00 01 00 00 00 |?...............|
|
|
444
|
+
00000050 00 00 00 00 00 00 00 00 00 00 00 00 d6 02 00 00 |................|
|
|
445
|
+
00000060 01 00 53 00 74 00 72 00 69 00 6e 00 67 00 46 00 |..S.t.r.i.n.g.F.|
|
|
446
|
+
00000070 69 00 6c 00 65 00 49 00 6e 00 66 00 6f 00 00 00 |i.l.e.I.n.f.o...|
|
|
447
|
+
00000080 b2 02 00 00 01 00 30 00 34 00 30 00 39 00 30 00 |......0.4.0.9.0.|
|
|
448
|
+
00000090 34 00 42 00 30 00 00 00 4c 00 16 00 01 00 43 00 |4.B.0...L.....C.|
|
|
449
|
+
|
|
450
|
+
by offset:
|
|
451
|
+
|
|
452
|
+
# pedump calc.exe --extract resource:0x98478 | head
|
|
453
|
+
|
|
454
|
+
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
|
|
455
|
+
<!-- Copyright (c) Microsoft Corporation -->
|
|
456
|
+
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
|
|
457
|
+
<assemblyIdentity
|
|
458
|
+
name="Microsoft.Windows.Shell.calc"
|
|
459
|
+
processorArchitecture="x86"
|
|
460
|
+
version="5.1.0.0"
|
|
461
|
+
type="win32"/>
|
|
462
|
+
<description>Windows Shell</description>
|
|
463
|
+
<dependency>
|
|
464
|
+
|
|
465
|
+
#### Sections
|
|
466
|
+
|
|
467
|
+
by name:
|
|
468
|
+
|
|
469
|
+
# pedump calc.exe --extract section:.text | hexdump -C | head -4
|
|
470
|
+
|
|
471
|
+
00000000 0b aa cb 77 f7 c4 cc 77 a4 c4 cc 77 c4 c4 cc 77 |...w...w...w...w|
|
|
472
|
+
00000010 3e d7 ca 77 ec b4 cb 77 69 9c f0 77 dc c4 cc 77 |>..w...wi..w...w|
|
|
473
|
+
00000020 12 9c cb 77 4d af cb 77 b4 c4 cc 77 6e a8 ee 77 |...wM..w...wn..w|
|
|
474
|
+
00000030 14 fc f0 77 00 00 00 00 2c 92 04 76 09 62 04 76 |...w....,..v.b.v|
|
|
475
|
+
|
|
476
|
+
by RVA:
|
|
477
|
+
|
|
478
|
+
# pedump calc.exe --extract section:rva/0x1000 | hexdump -C | head -4
|
|
479
|
+
|
|
480
|
+
00000000 0b aa cb 77 f7 c4 cc 77 a4 c4 cc 77 c4 c4 cc 77 |...w...w...w...w|
|
|
481
|
+
00000010 3e d7 ca 77 ec b4 cb 77 69 9c f0 77 dc c4 cc 77 |>..w...wi..w...w|
|
|
482
|
+
00000020 12 9c cb 77 4d af cb 77 b4 c4 cc 77 6e a8 ee 77 |...wM..w...wn..w|
|
|
483
|
+
00000030 14 fc f0 77 00 00 00 00 2c 92 04 76 09 62 04 76 |...w....,..v.b.v|
|
|
484
|
+
|
|
485
|
+
by RAW_PTR (file offset):
|
|
486
|
+
|
|
487
|
+
# pedump calc.exe --extract section:raw/0x400 | hexdump -C | head -4
|
|
488
|
+
|
|
489
|
+
00000000 0b aa cb 77 f7 c4 cc 77 a4 c4 cc 77 c4 c4 cc 77 |...w...w...w...w|
|
|
490
|
+
00000010 3e d7 ca 77 ec b4 cb 77 69 9c f0 77 dc c4 cc 77 |>..w...wi..w...w|
|
|
491
|
+
00000020 12 9c cb 77 4d af cb 77 b4 c4 cc 77 6e a8 ee 77 |...wM..w...wn..w|
|
|
492
|
+
00000030 14 fc f0 77 00 00 00 00 2c 92 04 76 09 62 04 76 |...w....,..v.b.v|
|
|
493
|
+
|
|
494
|
+
#### Data Directory
|
|
495
|
+
|
|
496
|
+
# pedump calc.exe --extract datadir:IMPORT | hexdump -C | head -4
|
|
497
|
+
|
|
498
|
+
00000000 90 9f 04 00 ff ff ff ff ff ff ff ff dc a2 04 00 |................|
|
|
499
|
+
00000010 48 12 00 00 f4 a0 04 00 ff ff ff ff ff ff ff ff |H...............|
|
|
500
|
+
00000020 10 a5 04 00 ac 13 00 00 48 9d 04 00 ff ff ff ff |........H.......|
|
|
501
|
+
00000030 ff ff ff ff f6 a5 04 00 00 10 00 00 5c 9f 04 00 |............\...|
|
|
502
|
+
|
|
408
503
|
License
|
|
409
504
|
-------
|
|
410
505
|
Released under the MIT License. See the [LICENSE](https://github.com/zed-0xff/pedump/blob/master/LICENSE.txt) file for further details.
|