SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
dumping-and-rebuilding-a-pe-from-memory
0
Rebuilds a usable PE file from a memory dump by fixing the section alignment (virtual-to-raw), correcting the entry point, and preparing for import table reconstruction. Activates for requests to rebuild a dumped PE, fix a memory-dumped executable, or convert a process dump into an analyzable file.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Dumping and Rebuilding a PE From Memory ## When to Use - You have a process/region dump of an unpacked or injected PE and need a file that loads in a disassembler. - You need to convert virtual (loaded) layout back toward raw layout and fix the entry point. **Do not use** this on a still-packed image — unpack to OEP first. This skill operates on an already-captured dump; it does not execute the sample. ## Prerequisites - A raw PE dump (e.g., from x64dbg Scylla, vaddump) and the OEP if known. ## Safety & Handling - The dump is live malicious code; store password-protected and never execute it. ## Workflow ### Step 1: Inspect the dumped headers ```bash python scripts/analyst.py inspect dump.bin ``` Reports whether section RawAddress/RawSize match VirtualAddress/VirtualSize (memory-aligned dumps have raw==virtual) and the current AddressOfEntryPoint. ### Step 2: Realign sections to raw layout ```bash python scripts/analyst.py fix dump.bin --oep 0x1234 -o rebuilt.bin ``` Rewrites each section's PointerToRawData/SizeOfRawData to its virtual layout (the on-disk-from- memory convention) and sets the entry point to the supplied OEP. ### Step 3: Reconstruct imports The dumped image usually has a destroyed IAT; rebuild it with an import reconstructor (Scylla/ ImpRec) using the OEP, then re-inspect. ### Step 4: Verify Confirm the rebuilt file parses, has a valid entry point, and disassembles. ## Validation - Section table is internally consistent (no overlaps, within file size). - AddressOfEntryPoint points inside an executable section. - The rebuilt file is accepted by a PE parser/disassembler. ## Pitfalls - Forgetting that memory dumps use virtual alignment — raw offsets must be rewritten. - Setting an OEP RVA that lies outside any section. - Skipping IAT reconstruction, leaving call targets pointing at null/garbage. ## References - See [`references/api-reference.md`](references/api-reference.md) for the rebuilder. - PE format spec and ATT&CK T1620 (linked in frontmatter).