pedump-ruby
root@kali:~# pedump-ruby -h
Usage: pedump [options]
--version Print version information and exit
-v, --verbose Run verbosely
(can be used multiple times)
-q, --quiet Silent any warnings
(can be used multiple times)
-F, --force Try to dump by all means
(can cause exceptions & heavy wounds)
-f, --format FORMAT Output format: bin,c,dump,hex,inspect,json,table,yaml
(default: table)
--mz
--dos-stub
--rich
--pe
--ne
--te
--data-directory
-S, --sections
--tls
--security
-s, --strings
-R, --resources
--resource-directory
-I, --imports
-E, --exports
-V, --version-info
--packer
--deep packer deep scan, significantly slower
-P, --packer-only packer/compiler detect only,
mimics 'file' command output
-r, --recursive recurse dirs in packer detect
--all Dump all but resource-directory (default)
--extract ID Extract a resource/section/data_dir
ID: datadir:EXPORT - datadir by type
ID: resource:0x98478 - resource by offset
ID: resource:ICON/#1 - resource by type & name
ID: section:.text - section by name
ID: section:rva/0x1000 - section by RVA
ID: section:raw/0x400 - section by RAW_PTR
--va2file VA Convert RVA to file offset
-W, --web Uploads files to a https://pedump.me
for a nice HTML tables with image previews,
candies & stuff
-C, --console opens IRB console with specified file loaded