Dumping And Rebuilding A Pe From Memory

Dumping and Rebuilding a PE From Memory

When to Use

• You have a process/region dump of an unpacked or injected PE and need a file that loads in a

disassembler.

• You need to convert virtual (loaded) layout back toward raw layout and fix the entry point.

Do not use this on a still-packed image — unpack to OEP first. This skill operates on an already-captured dump; it does not execute the sample.

Prerequisites

• A raw PE dump (e.g., from x64dbg Scylla, vaddump) and the OEP if known.

Safety & Handling

• The dump is live malicious code; store password-protected and never execute it.

Workflow

Step 1: Inspect the dumped headers

python scripts/analyst.py inspect dump.bin

Reports whether section RawAddress/RawSize match VirtualAddress/VirtualSize (memory-aligned dumps have raw==virtual) and the current AddressOfEntryPoint.

Step 2: Realign sections to raw layout

python scripts/analyst.py fix dump.bin --oep 0x1234 -o rebuilt.bin

Rewrites each section's PointerToRawData/SizeOfRawData to its virtual layout (the on-disk-from- memory convention) and sets the entry point to the supplied OEP.

Step 3: Reconstruct imports

The dumped image usually has a destroyed IAT; rebuild it with an import reconstructor (Scylla/ ImpRec) using the OEP, then re-inspect.

Step 4: Verify

Confirm the rebuilt file parses, has a valid entry point, and disassembles.

Validation

• Section table is internally consistent (no overlaps, within file size).
• AddressOfEntryPoint points inside an executable section.
• The rebuilt file is accepted by a PE parser/disassembler.

Pitfalls

• Forgetting that memory dumps use virtual alignment — raw offsets must be rewritten.
• Setting an OEP RVA that lies outside any section.
• Skipping IAT reconstruction, leaving call targets pointing at null/garbage.

References

• See [references/api-reference.md](references/api-reference.md) for the rebuilder.
• PE format spec and ATT&CK T1620 (linked in frontmatter).

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: meltedinhex
• Source: meltedinhex/analyst-ai-pack
• License: Apache-2.0
• Homepage: https://meltedinhex.com/

Install and usage instructions live in the source repository linked above.