# Dumping And Rebuilding A Pe From Memory

> Rebuilds a usable PE file from a memory dump by fixing the section alignment

- **Type:** Skill
- **Install:** `agentstack add skill-meltedinhex-analyst-ai-pack-dumping-and-rebuilding-a-pe-from-memory`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [meltedinhex](https://agentstack.voostack.com/s/meltedinhex)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [meltedinhex](https://github.com/meltedinhex)
- **Source:** https://github.com/meltedinhex/analyst-ai-pack/tree/main/skills/dumping-and-rebuilding-a-pe-from-memory
- **Website:** https://meltedinhex.com/

## Install

```sh
agentstack add skill-meltedinhex-analyst-ai-pack-dumping-and-rebuilding-a-pe-from-memory
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Dumping and Rebuilding a PE From Memory

## When to Use

- You have a process/region dump of an unpacked or injected PE and need a file that loads in a
  disassembler.
- You need to convert virtual (loaded) layout back toward raw layout and fix the entry point.

**Do not use** this on a still-packed image — unpack to OEP first. This skill operates on an
already-captured dump; it does not execute the sample.

## Prerequisites

- A raw PE dump (e.g., from x64dbg Scylla, vaddump) and the OEP if known.

## Safety & Handling

- The dump is live malicious code; store password-protected and never execute it.

## Workflow

### Step 1: Inspect the dumped headers

```bash
python scripts/analyst.py inspect dump.bin
```

Reports whether section RawAddress/RawSize match VirtualAddress/VirtualSize (memory-aligned dumps
have raw==virtual) and the current AddressOfEntryPoint.

### Step 2: Realign sections to raw layout

```bash
python scripts/analyst.py fix dump.bin --oep 0x1234 -o rebuilt.bin
```

Rewrites each section's PointerToRawData/SizeOfRawData to its virtual layout (the on-disk-from-
memory convention) and sets the entry point to the supplied OEP.

### Step 3: Reconstruct imports

The dumped image usually has a destroyed IAT; rebuild it with an import reconstructor (Scylla/
ImpRec) using the OEP, then re-inspect.

### Step 4: Verify

Confirm the rebuilt file parses, has a valid entry point, and disassembles.

## Validation

- Section table is internally consistent (no overlaps, within file size).
- AddressOfEntryPoint points inside an executable section.
- The rebuilt file is accepted by a PE parser/disassembler.

## Pitfalls

- Forgetting that memory dumps use virtual alignment — raw offsets must be rewritten.
- Setting an OEP RVA that lies outside any section.
- Skipping IAT reconstruction, leaving call targets pointing at null/garbage.

## References

- See [`references/api-reference.md`](references/api-reference.md) for the rebuilder.
- PE format spec and ATT&CK T1620 (linked in frontmatter).

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [meltedinhex](https://github.com/meltedinhex)
- **Source:** [meltedinhex/analyst-ai-pack](https://github.com/meltedinhex/analyst-ai-pack)
- **License:** Apache-2.0
- **Homepage:** https://meltedinhex.com/

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-meltedinhex-analyst-ai-pack-dumping-and-rebuilding-a-pe-from-memory
- Seller: https://agentstack.voostack.com/s/meltedinhex
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.