embedded pe ripper

pulls embedded PE files out of a host binary. that's pretty much it.

useful if you're doing some pc checking and want to see what's hiding inside an executable, or just poking around during reverse engineering and notice a file is way bigger than it should be.

---

what it does

scans a given .exe or .dll for any PE files (.exe, .dll, etc.) embedded inside it. when it finds one it dumps it out as embedded_0.bin, embedded_1.bin, and so on. skips the host PE itself so you're only getting the payloads.

---

usage

python ripper.py <exe_or_dll>

example:

python ripper.py suspicious.exe

no dependencies outside of stdlib. just python 3.10+.

---

showcase

video.mp4

---

notes

• starts scanning at offset 0x400 to skip past the host PE header
• validates MZ ? PE signature chain before dumping, so no false positives from random MZ bytes
• extracted files land in whatever directory you ran the script from

---

made by

ryze � discord: ryze.xzy server: discord.gg/unimaginablev1