Skip to content

Instantly share code, notes, and snippets.

@ktwr-
Created October 4, 2021 00:15
Show Gist options
  • Save ktwr-/62abb2add98aa3a9d4a19d1b6dd94f43 to your computer and use it in GitHub Desktop.
Save ktwr-/62abb2add98aa3a9d4a19d1b6dd94f43 to your computer and use it in GitHub Desktop.
import pefile
file ="filename"
pe = pefile.PE(file)
jack_entry = None
for entry in pe.DIRECTORY_ENTRY_RESOURCE.entries:
if str(entry.name) == "ASSEMBLY_LZMA":
jack_entry = entry
for entry in jack_entry.directory.entries:
if str(entry.name) == "JACK":
data_rva = entry.directory.entries[0].data.struct.OffsetToData
size = entry.directory.entries[0].data.struct.Size
data = pe.get_memory_mapped_image()[data_rva:data_rva+size]
with open("JACK","wb") as f:
f.write(data)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment