Executable file parsing and extraction - PE/NE/LE/ROM/ELF/XBE

[aluigi]

This is a script that I wrote just to experiment some feature of quickbms and that now is really very useful to parse and extract the executable files:
http://aluigi.org/bms/parse_exe.bms

There are many resource extractors out there (ResHacker for example) but today I updated it to version 0.3 with support for other types of executables like "NE" (New Executable) which is an old 16bit Win31-era type.
The game "Reader Rabbit's Reading Development Library 1" or "Reading Development Library" had all its files embedded in various DLL files but there are almost no extractors available (an old shareware one is here).

I had already lot of code implemented in my QuickRVA tool so was quite easy to port it to the script.
Currently supports:

• PE 32/64
• NE
• LE
• ROM/VXD
• ELF32
• ELF64
• XBE

Keywords: extract resources 16bit new executable

[AnonBaiter]

I've been getting nifty error from this file alone when running with this script:

Code: Select all

  00497f90 1567068    00597200_00497f90_0017e95c_.dat

Error: incomplete input file 0: E:\ROCKSTAR_LEL\THE_WARRIORS\PS2\SLUS_212.15
       Can't read 961384 bytes from offset 004ad428.
       Anyway don't worry, it's possible that the BMS script has been written
       to exit in this way if it's reached the end of the archive so check it
       or contact its author or verify that all the files have been extracted.
       Please check the following coverage information to know if it's ok.

  coverage file 0   101%   4985231    4903976

Last script line before the error or that produced the error:
  39  log NAME PointerToRawData SizeOfRawData

The file itself in question is in the attachment.

[aluigi]

Script 0.3.1, now the sections are sorted and limited by the offset of the next one without the possibility to read over.

[AntonZab]

This script supports DOS executable?

[aluigi]

As far as I remember the MSDOS executables don't have resources or at least not a standard format for them, in fact they have just the initial "MZ" header.