how to extract a file embedded in an .exe?

Question

for some months nearly a year of reversing an app not for cracking but my is to see the difference between the registered version and the unregistered one. according to my research both apps(registered or not) displays a dialog but the unregistered version have two header files in different position, I found that using XORSearch and I thought like there is another executable inside the unregistered app then and I also found some calls like

     005A0B8E    mov        edx,5A0D88; '[my documents]'
     005A0B93    call       @UStrLAsg
     005A0B98    lea        edx,[ebp-18]
     005A0B9B    mov        eax,dword ptr [ebp-4]
     005A0B9E    call       LowerCase
     005A0BA3    mov        edx,dword ptr [ebp-18]
     005A0BA6    mov        eax,dword ptr [ebp-0C]
     005A0BA9    call       Pos
     005A0BAE    test       eax,eax
    >005A0BB0    jle        005A0BE1
     005A0BB2    lea        edx,[ebp-8]
     005A0BB5    mov        eax,5
     005A0BBA    call       005A0A7C
     005A0BBF    movzx      eax,byte ptr ds:[5A0D78]; 0x3
     005A0BC6    push       eax
     005A0BC7    push       ebx
     005A0BC8    lea        edx,[ebp-1C]
     005A0BCB    mov        eax,dword ptr [ebp-4]
     005A0BCE    call       LowerCase
     005A0BD3    mov        eax,dword ptr [ebp-1C]
     005A0BD6    mov        ecx,dword ptr [ebp-8]
     005A0BD9    mov        edx,dword ptr [ebp-0C]
     005A0BDC    call       StringReplace
     005A0BE1    lea        eax,[ebp-0C]
     005A0BE4    mov        edx,5A0DB4; '[all users documents]'
     005A0BE9    call       @UStrLAsg
     005A0BEE    lea        edx,[ebp-20]
     005A0BF1    mov        eax,dword ptr [ebp-4]
     005A0BF4    call       LowerCase
     005A0BF9    mov        edx,dword ptr [ebp-20]
     005A0BFC    mov        eax,dword ptr [ebp-0C]
     005A0BFF    call       Pos
     005A0C04    test       eax,eax
    >005A0C06    jle        005A0C37
     005A0C08    lea        edx,[ebp-8]
     005A0C0B    mov        eax,2E
     005A0C10    call       005A0A7C
     005A0C15    movzx      eax,byte ptr ds:[5A0D78]; 0x3
     005A0C1C    push       eax
     005A0C1D    push       ebx
     005A0C1E    lea        edx,[ebp-24]
     005A0C21    mov        eax,dword ptr [ebp-4]
     005A0C24    call       LowerCase
     005A0C29    mov        eax,dword ptr [ebp-24]
     005A0C2C    mov        ecx,dword ptr [ebp-8]
     005A0C2F    mov        edx,dword ptr [ebp-0C]
     005A0C32    call       StringReplace
     005A0C37    lea        eax,[ebp-0C]
     005A0C3A    mov        edx,5A0DEC; '[program folder]'
     005A0C3F    call       @UStrLAsg
     005A0C44    lea        edx,[ebp-28]
     005A0C47    mov        eax,dword ptr [ebp-4]
     005A0C4A    call       LowerCase
     005A0C4F    mov        edx,dword ptr [ebp-28]
     005A0C52    mov        eax,dword ptr [ebp-0C]
     005A0C55    call       Pos
     005A0C5A    test       eax,eax
    >005A0C5C    jle        005A0CA5
     005A0C5E    lea        edx,[ebp-30]
     005A0C61    mov        eax,[005CC76C]; ^Application:TApplication
     005A0C66    mov        eax,dword ptr [eax]
     005A0C68    call       TApplication.GetExeName
     005A0C6D    mov        eax,dword ptr [ebp-30]
     005A0C70    lea        edx,[ebp-2C]
     005A0C73    call       ExtractFileDir
     005A0C78    mov        eax,dword ptr [ebp-2C]
     005A0C7B    lea        edx,[ebp-8]
     005A0C7E    call       IncludeTrailingPathDelimiter
     005A0C83    movzx      eax,byte ptr ds:[5A0D78]; 0x3
     005A0C8A    push       eax
     005A0C8B    push       ebx
     005A0C8C    lea        edx,[ebp-34]
     005A0C8F    mov        eax,dword ptr [ebp-4]
     005A0C92    call       LowerCase
     005A0C97    mov        eax,dword ptr [ebp-34]
     005A0C9A    mov        ecx,dword ptr [ebp-8]
     005A0C9D    mov        edx,dword ptr [ebp-0C]
     005A0CA0    call       StringReplace
     005A0CA5    lea        eax,[ebp-0C]
     005A0CA8    mov        edx,5A0E1C; '[desktop]'
     005A0CAD    call       @UStrLAsg
     005A0CB2    lea        edx,[ebp-38]
     005A0CB5    mov        eax,dword ptr [ebp-4]
     005A0CB8    call       LowerCase
     005A0CBD    mov        edx,dword ptr [ebp-38]
     005A0CC0    mov        eax,dword ptr [ebp-0C]
     005A0CC3    call       Pos
     005A0CC8    test       eax,eax
    >005A0CCA    jle        005A0CF8
     005A0CCC    lea        edx,[ebp-8]
     005A0CCF    xor        eax,eax
     005A0CD1    call       005A0A7C
     005A0CD6    movzx      eax,byte ptr ds:[5A0D78]; 0x3
     005A0CDD    push       eax
     005A0CDE    push       ebx
     005A0CDF    lea        edx,[ebp-3C]
     005A0CE2    mov        eax,dword ptr [ebp-4]
     005A0CE5    call       LowerCase
     005A0CEA    mov        eax,dword ptr [ebp-3C]
     005A0CED    mov        ecx,dword ptr [ebp-8]
     005A0CF0    mov        edx,dword ptr [ebp-0C]
     005A0CF3    call       StringReplace
     005A0CF8    lea        edx,[ebp-40]
     005A0CFB    mov        eax,dword ptr [ebx]
     005A0CFD    call       ExcludeTrailingPathDelimiter
     005A0D02    mov        edx,dword ptr [ebp-40]
     005A0D05    mov        eax,ebx
     005A0D07    call       @UStrAsg

is it possible to extract an executable inside another executable an d how?

Is it a .NET CLR EXE? If it is, use Telerik JustDecompile. – Coderkids Official Jun 06 '19 at 00:59 — Coderkids Official, Jun 06 '19 at 00:59

score 4 · Accepted Answer · edited Apr 13 '17 at 12:49

It is possible. Where is the embedded executable located? Based on my experience there are a couple of locations:

Overlay: If it is in overlay, just select it entirely from the "MZ" signature to the end and dump it. Try to open it in the debugger then to see if it is working. More about this can be found here
Resource: If the embedded file is part of the resource, just dump the appropriate resource using some tool like LordPE
Section: This is the most trickiest case if you are new to this. Locate the first byte of the embedded PE file (the "MZ" signature bytes). From there position at offset 0x150. There you have a 4 byte value which contains the SizeOfImage. The SizeOfImage field tells you how much memory space the PE file takes when loaded in memory. When you get that value, you can select that many bytes and dump them. This way you are sure that the entire embedded file will be dumped.

NOTE: If the original file has overlay, it would be a good idea to copy that overlay to the embedded file once you extract it because it is possible that the dumped file will make use of the overlay data.

how can I dump it, can use OllyDbg, with all these PE size 17.7mb File size 2.24 mb — Alexio puk2sefu, Feb 20 '16 at 00:20

score 0 · Answer 2 · answered Feb 15 '16 at 09:32

0

(assuming the file inside is not encrypted) you could try to look for hex values 4D 5A 90 00 it's start of DOS header then copy everything until the end and paste into new file.

answered Feb 15 '16 at 09:32

krusty

367
2
11

bytes not found, maybe the file inside is protected or doesn't have DOS stub – Alexio puk2sefu Feb 20 '16 at 00:24

how to extract a file embedded in an .exe?

2 Answers2