agentsclimarketplace

Dumping and rebuilding a pe from memory

Skill meltedinhex/analyst-ai-pack/skills/dumping-and-rebuilding-a-pe-from-memory

An open agent-skills library for malware analysis, reverse engineering, and threat hunting - 118 curated, runnable skills mapped to MITRE ATT&CK, D3FEND, and CAR.

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill dumping-and-rebuilding-a-pe-from-memory

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 19 stars19 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Rebuilds a usable PE file from a memory dump by fixing the section alignment (virtual-to-raw), correcting the entry point, and preparing for import table reconstruction. Activates for requests to rebuild a dumped PE, fix a memory-dumped executable, or convert a process dump into an analyzable file.

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.8 KB, as published. Nobody here has run it

Dumping and Rebuilding a PE From Memory

When to Use

  • You have a process/region dump of an unpacked or injected PE and need a file that loads in a disassembler.
  • You need to convert virtual (loaded) layout back toward raw layout and fix the entry point.

Do not use this on a still-packed image — unpack to OEP first. This skill operates on an already-captured dump; it does not execute the sample.

Prerequisites

  • A raw PE dump (e.g., from x64dbg Scylla, vaddump) and the OEP if known.

Safety & Handling

  • The dump is live malicious code; store password-protected and never execute it.

Workflow

Step 1: Inspect the dumped headers

python scripts/analyst.py inspect dump.bin

Reports whether section RawAddress/RawSize match VirtualAddress/VirtualSize (memory-aligned dumps have raw==virtual) and the current AddressOfEntryPoint.

Step 2: Realign sections to raw layout

python scripts/analyst.py fix dump.bin --oep 0x1234 -o rebuilt.bin

Rewrites each section's PointerToRawData/SizeOfRawData to its virtual layout (the on-disk-from- memory convention) and sets the entry point to the supplied OEP.

Step 3: Reconstruct imports

The dumped image usually has a destroyed IAT; rebuild it with an import reconstructor (Scylla/ ImpRec) using the OEP, then re-inspect.

Step 4: Verify

Confirm the rebuilt file parses, has a valid entry point, and disassembles.

Validation

  • Section table is internally consistent (no overlaps, within file size).
  • AddressOfEntryPoint points inside an executable section.
  • The rebuilt file is accepted by a PE parser/disassembler.

Pitfalls

  • Forgetting that memory dumps use virtual alignment — raw offsets must be rewritten.
  • Setting an OEP RVA that lies outside any section.
  • Skipping IAT reconstruction, leaving call targets pointing at null/garbage.

References

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.