Recover and statically analyze manually-mapped DLLs (in-process implants, malware loaders, packers, anti-cheat modules) whose PE headers are wiped at runtime. Use when the user asks to dump a hidden DLL from a process, find a manually-mapped module, recover a headerless PE, reconstruct a wiped image, identify hooks installed by an in-process implant, or analyze a code region whose `MZ`/`PE\0\0` he
Receba novas skills de Desenvolvimento toda segunda
1 email curto, só com as skills novas de Desenvolvimento. 4 minutos de leitura, sem spam, cancela com 1 clique.
Você confirma o email no primeiro envio. Sem spam. Cancela com 1 clique.
Ler descrição completaRecolher descrição
PEReconstruct skill
This skill drives the PEReconstruct toolkit — a pure-stdlib Python pipeline for finding manually-mapped DLLs in a running process and rebuilding a loadable PE so IDA can analyze the dump.
Pipeline (read this before running anything)
PID → scan_exec_private.py (find candidate RX private regions)
→ scan_pe_deep.py (optional: PE-sig sweep for headerless)
→ pick the best candidate (size 1-10 MB, entropy ~6-7)
→ rebuild_header
[Description truncada. Veja o README completo no GitHub.]
