Add PE resource extraction

malduck/main.py

@@ -4,6 +4,8 @@
 import os
 
 from .procmem import ProcessMemoryPE
+from .pe import PE
+from pathlib import Path
 
 
 @click.group()
@@ -127,3 +129,28 @@ def echo_config(extract_manager, file_path=None):
                 extract_manager = ExtractManager(extractor_modules)
         if analysis:
             echo_config(extract_manager)
+
+
+@main.command("resources")
+@click.argument("filepath", type=click.Path(exists=True))
+@click.argument("outpath", type=click.Path())
+def extract_resources(filepath, outpath):
+    """Extract PE resources from an EXE into a directory"""
+    with open(filepath, "rb") as f:
+        pe = PE(data=f.read())
+
+    out_dir = Path(outpath)
+    out_dir.mkdir(exist_ok=True)
+
+    for e1, e2, e3 in pe.iterate_resources():
+        e1_name = e1.name.string.decode() if e1.name else e1.id
+        e2_name = e2.name.string.decode() if e2.name else e2.id
+        res_data = pe.pe.get_data(e3.data.struct.OffsetToData, e3.data.struct.Size)
+        out_name = f"{e1_name}-{e2_name}"
+
+        click.echo(f"Found resource {out_name} ({len(res_data)} bytes)")
+
+        # make sure there's no funny business
+        Path(out_dir).joinpath(out_dir / out_name).resolve().relative_to(
+            out_dir.resolve()
+        ).write_bytes(res_data)

malduck/pe.py

@@ -4,7 +4,7 @@
 
 import pefile
 
-from typing import Any, Iterator, Optional, Union, TYPE_CHECKING
+from typing import Any, Iterator, Optional, Union, TYPE_CHECKING, Tuple
 
 if TYPE_CHECKING:
     from .procmem import ProcessMemory
@@ -288,6 +288,20 @@ def validate_padding(self) -> bool:
         except pefile.PEFormatError:
             return False
 
+    def iterate_resources(
+        self,
+    ) -> Iterator[
+        Tuple[
+            pefile.ResourceDirEntryData,
+            pefile.ResourceDirEntryData,
+            pefile.ResourceDirEntryData,
+        ]
+    ]:
+        for e1 in self.pe.DIRECTORY_ENTRY_RESOURCE.entries:
+            for e2 in e1.directory.entries:
+                for e3 in e2.directory.entries:
+                    yield (e1, e2, e3)
+
     def resources(self, name: Union[int, str, bytes]) -> Iterator[bytes]:
         """
         Finds resource objects by specified name or type
@@ -325,13 +339,9 @@ def type_int(e1, e2, e3):
         else:
             compare = name_int
 
-        for e1 in self.pe.DIRECTORY_ENTRY_RESOURCE.entries:
-            for e2 in e1.directory.entries:
-                for e3 in e2.directory.entries:
-                    if compare(e1, e2, e3):
-                        yield self.pe.get_data(
-                            e3.data.struct.OffsetToData, e3.data.struct.Size
-                        )
+        for e1, e2, e3 in self.iterate_resources():
+            if compare(e1, e2, e3):
+                yield self.pe.get_data(e3.data.struct.OffsetToData, e3.data.struct.Size)
 
     def resource(self, name: Union[int, str, bytes]) -> Optional[bytes]:
         """