Skip to content

Extract the resources (.rsrc section) from PE file #12

@bonigarcia

Description

@bonigarcia

I want to extract the resources (.rsrc section) from the following PE file (152.8 MB). I got that file from the Edge MSI installer (inside the Binary.MicrosoftEdgeInstaller stream).

I tried to use pecli for that aim, and with that, I managed to dump that section using the following command:

$ pecli dump --section rsrc --output extract MicrosoftEdge_X64_116.0.1938.76.exe.\{0D50BFEC-CD6A-4F9A-964C-C7416E3ACB10\} 
Section .rsrc written in extract

As the output says, a file called extract is created. But that is not exactly what I need.

As far as I believe, the .rsrc section in a PE file contains resources indexed by a multiple-level binary-sorted tree structure (see source). And I want to extract that tree structure (composed by folders and files) from the PE file. In theory, in that tree structure I will find the Microsoft Edge binary distribution for Windows.

Is it possible to extract?

Any clue on this is greatly appreciated.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions