How can one extract the appended data of a Portable Executable?

Question

How do you reliably extract appended data in a Portable Executable?

(I was asked in relation with this question) – Ange May 06 '13 at 11:01 — Ange, May 06 '13 at 11:01

Ange · Answer 1 · 2013-05-06T11:54:48.547

10

Just to clarify: the appended data - also called overlay - is the part of a PE file that is not covered by the header.

enter image description here

Because of some tricky conditions in the PE file format, it might be difficult to determine in some extreme case, so it's better to rely on a robust library such as pefile.

Here is a simple Python script that relies on pefile to extract the appended data:

import pefile
import sys

filename = sys.argv[1]
with open(filename, "rb") as s:
    r = s.read()

pe = pefile.PE(filename)
offset = pe.get_overlay_data_start_offset()

with open(filename + ".app", "wb") as t:
    t.write(r[offset:])

use with your filename as argument.

Personally, I usually do it with Hiew - as Hiew is faster to start than anything else, and also PE-robust:

go at appended data start
1. in Hex or ASM mode, press F8 to view PE header information
2. Alt+F2 to go at appended data start
select until the end
1. Keypad-* to start selection
2. Ctrl+End to go at bottom of the file
3. Keypad-* again to finish selection
F2 to write selection to file

edited May 06 '13 at 11:54

answered May 06 '13 at 10:59

Ange

6,694
3
28
62

2

You may want to skip an existing Authenticode signature as well. – 0xC0000022L May 06 '13 at 13:53
no, the Authenticode signature must be last in the file or it will fail validation. You cannot (any more) append data after the signature. – peter ferrie May 07 '13 at 17:11
There could be a signature at the end of the appended data, so one might not want to select until the bottom of the file. – Ange May 07 '13 at 18:40
1

if there is a signature then it'll be recorded in the data directory, so you have the start offset and size there, its pretty simple – evlncrn8 Oct 11 '14 at 22:50
https://asciinema.org/a/171993 – evandrix Apr 07 '21 at 00:11

score 6 · Answer 2 · answered May 06 '13 at 11:37

6

It is not that hard to do manually.

Find the PE header from the MZ header and determine the location of the section table.
Walk the section table, and determine the maximum value of PointerToRawData + SizeOfRawData. (note: these values are subject to alignment using the FileAlignment member of the IMAGE_OPTIONAL_HEADER).
Use the determined maximum as the file offset to the overlay data.

Note that some installers/file formats do not actually use this calculation, but they instead have a small trailer at the end of file which points to the beginning of the payload. For example, ZIP file format works like that - that's why a self-extracting ZIP can be extracted irregardless of whether the unpacker stub is PE, DOS MZ, ELF, Mach-O or anything else.

answered May 06 '13 at 11:37

Igor Skochinsky

36,553
7
65
115

no, this is not sufficient. SizeOfRawData can have any value, even gigabytes large in a small file. It's bound by VirtualSize at that point. Accurately determining the end of the image is not trivial. – peter ferrie May 06 '13 at 19:13
@peterferrie What would be a good algorithm? I am actually trying to implement one. pefile does it roughly as suggested here. – Karsten Hahn May 13 '14 at 08:12
@Veitch, my answer to your other question now has sample code and a description, which should be what you need. – peter ferrie May 13 '14 at 22:35

score 0 · Answer 3 · answered Jan 19 '21 at 02:40

Another option is the mewrev/pe Go package:

package main
import (
   "github.com/mewrev/pe"
   "io/ioutil"
   "log"
   "os"
)
func main() {
   file, e := pe.Open("vs_BuildTools.exe")
   if e != nil {
      log.Fatal(e)
   }
   y, e := file.Overlay()
   if e != nil {
      log.Fatal(e)
   }
   ioutil.WriteFile("vs_BuildTools.overlay", y, os.ModePerm)
}

How can one extract the appended data of a Portable Executable?

3 Answers3

Linked