How to find DOS Header and PE Header with an entry point in Radare2?

Question

I am currently doing byte extraction from PE files using Radare2. I know how to find the byte sequence for DOS Header and PE Header when there is no entry point and the start is defaulted to 0x0. But some of them have an entry point at 0x4#####.
I can retrieve the vaddr (virtual address), paddr (physical address), and haddr  (e_entryAddressOfEntryPoint in the binary header) of a certain file with an entry point.
How do I use that to find the byte sequence for the DOS Header and PE Header?

Paweł Łukasik · Answer

You can load the file as raw, using -n or -nn option and then you will have those structures available at 0x0.
r2 -n ./open-wsl.exe

It also contains some function to operate and print on those structures in a nicer form. Check the pf? group for more info.

How to find DOS Header and PE Header with an entry point in Radare2?

One Answer

Add your own answers!

Ask a Question