dumping-and-rebuilding-a-pe-from-memory

Name: dumping-and-rebuilding-a-pe-from-memory
Author: meltedinhex

18stars5forks

How to install dumping-and-rebuilding-a-pe-from-memory?

meltedinhex/analyst-ai-pack/dumping-and-rebuilding-a-pe-from-memory

$npx -y skills add meltedinhex/analyst-ai-pack --skill dumping-and-rebuilding-a-pe-from-memory

Installs into the current project.

Summary

Rebuilds a usable PE file from a memory dump by fixing the section alignment

Files · 1

View on GitHub

SKILL.md

1	# Dumping and Rebuilding a PE From Memory
2
3	## When to Use
4
5	- You have a process/region dump of an unpacked or injected PE and need a file that loads in a
6	disassembler.
7	- You need to convert virtual (loaded) layout back toward raw layout and fix the entry point.
8
9	Do not use this on a still-packed image — unpack to OEP first. This skill operates on an
10	already-captured dump; it does not execute the sample.
11
12	## Prerequisites
13
14	- A raw PE dump (e.g., from x64dbg Scylla, vaddump) and the OEP if known.
15
16	## Safety & Handling
17
18	- The dump is live malicious code; store password-protected and never execute it.
19
20	## Workflow
21
22	### Step 1: Inspect the dumped headers
23
24	```bash
25	python scripts/analyst.py inspect dump.bin
26	```
27
28	Reports whether section RawAddress/RawSize match VirtualAddress/VirtualSize (memory-aligned dumps
29	have raw==virtual) and the current AddressOfEntryPoint.
30
31	### Step 2: Realign sections to raw layout
32
33	```bash
34	python scripts/analyst.py fix dump.bin --oep 0x1234 -o rebuilt.bin
35	```
36
37	Rewrites each section's PointerToRawData/SizeOfRawData to its virtual layout (the on-disk-from-
38	memory convention) and sets the entry point to the supplied OEP.
39
40	### Step 3: Reconstruct imports
41
42	The dumped image usually has a destroyed IAT; rebuild it with an import reconstructor (Scylla/
43	ImpRec) using the OEP, then re-inspect.
44
45	### Step 4: Verify
46
47	Confirm the rebuilt file parses, has a valid entry point, and disassembles.
48
49	## Validation
50
51	- Section table is internally consistent (no overlaps, within file size).
52	- AddressOfEntryPoint points inside an executable section.
53	- The rebuilt file is accepted by a PE parser/disassembler.
54
55	## Pitfalls
56
57	- Forgetting that memory dumps use virtual alignment — raw offsets must be rewritten.
58	- Setting an OEP RVA that lies outside any section.
59	- Skipping IAT reconstruction, leaving call targets pointing at null/garbage.
60
61	## References
62
63	- See [`references/api-reference.md`](references/api-reference.md) for the rebuilder.
64	- PE format spec and ATT&CK T1620 (linked in frontmatter).

People who liked this also viewed

6 picks

Type

entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026471k1.3k
azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026470k1.3k
azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026466k1.3k
better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 202678k203
firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 202676k386
audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 202665k85

dumping-and-rebuilding-a-pe-from-memory

18stars5forks

View on GitHub

How to install dumping-and-rebuilding-a-pe-from-memory?

meltedinhex/analyst-ai-pack/dumping-and-rebuilding-a-pe-from-memory

$npx -y skills add meltedinhex/analyst-ai-pack --skill dumping-and-rebuilding-a-pe-from-memory

Installs into the current project.

Summary

Rebuilds a usable PE file from a memory dump by fixing the section alignment

Files · 1

View on GitHub

SKILL.md

1	# Dumping and Rebuilding a PE From Memory
2
3	## When to Use
4
5	- You have a process/region dump of an unpacked or injected PE and need a file that loads in a
6	disassembler.
7	- You need to convert virtual (loaded) layout back toward raw layout and fix the entry point.
8
9	Do not use this on a still-packed image — unpack to OEP first. This skill operates on an
10	already-captured dump; it does not execute the sample.
11
12	## Prerequisites
13
14	- A raw PE dump (e.g., from x64dbg Scylla, vaddump) and the OEP if known.
15
16	## Safety & Handling
17
18	- The dump is live malicious code; store password-protected and never execute it.
19
20	## Workflow
21
22	### Step 1: Inspect the dumped headers
23
24	```bash
25	python scripts/analyst.py inspect dump.bin
26	```
27
28	Reports whether section RawAddress/RawSize match VirtualAddress/VirtualSize (memory-aligned dumps
29	have raw==virtual) and the current AddressOfEntryPoint.
30
31	### Step 2: Realign sections to raw layout
32
33	```bash
34	python scripts/analyst.py fix dump.bin --oep 0x1234 -o rebuilt.bin
35	```
36
37	Rewrites each section's PointerToRawData/SizeOfRawData to its virtual layout (the on-disk-from-
38	memory convention) and sets the entry point to the supplied OEP.
39
40	### Step 3: Reconstruct imports
41
42	The dumped image usually has a destroyed IAT; rebuild it with an import reconstructor (Scylla/
43	ImpRec) using the OEP, then re-inspect.
44
45	### Step 4: Verify
46
47	Confirm the rebuilt file parses, has a valid entry point, and disassembles.
48
49	## Validation
50
51	- Section table is internally consistent (no overlaps, within file size).
52	- AddressOfEntryPoint points inside an executable section.
53	- The rebuilt file is accepted by a PE parser/disassembler.
54
55	## Pitfalls
56
57	- Forgetting that memory dumps use virtual alignment — raw offsets must be rewritten.
58	- Setting an OEP RVA that lies outside any section.
59	- Skipping IAT reconstruction, leaving call targets pointing at null/garbage.
60
61	## References
62
63	- See [`references/api-reference.md`](references/api-reference.md) for the rebuilder.
64	- PE format spec and ATT&CK T1620 (linked in frontmatter).

People who liked this also viewed

6 picks

Type