Skip to content

Extract the resources (.rsrc section) from PE file #12

Description

@bonigarcia

I want to extract the resources (.rsrc section) from the following PE file (152.8 MB). I got that file from the Edge MSI installer (inside the Binary.MicrosoftEdgeInstaller stream).

I tried to use pecli for that aim, and with that, I managed to dump that section using the following command:

$ pecli dump --section rsrc --output extract MicrosoftEdge_X64_116.0.1938.76.exe.\{0D50BFEC-CD6A-4F9A-964C-C7416E3ACB10\} 
Section .rsrc written in extract

As the output says, a file called extract is created. But that is not exactly what I need.

As far as I believe, the .rsrc section in a PE file contains resources indexed by a multiple-level binary-sorted tree structure (see source). And I want to extract that tree structure (composed by folders and files) from the PE file. In theory, in that tree structure I will find the Microsoft Edge binary distribution for Windows.

Is it possible to extract?

Any clue on this is greatly appreciated.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions