0

I am working on an assignment in packed malware analysis, in which I have to extract i.e. remove the header file of a PE malware and then I have to fragment the data. But I am unable to find out how to read and extract the header of a PE file.

Mridul Sachan
  • 93
  • 1
  • 2
  • 11

1 Answers1

1

Sorry for not taking better effort but well.. it is your assignment right? :)

PIMAGE_DOS_HEADER pDosHeader;
PIMAGE_NT_HEADERS pNtHeaders;

CreateFile("file.exe",...);
ReadFile(..,ptrBuf,...); 

pDosHeader = ptrBuf;
pNtHeaders = (PIMAGE_NT_HEADERS)(((PUCHAR)pDosHeader) + pDosHeader->e_lfanew);

Duh.. did you not pay attention during the class?

Pyjong
  • 3,095
  • 4
  • 32
  • 50