ruby-pedump

ruby-pedump is designed for reverse engineers and malware analysts working with Windows Portable Executable (PE) files. It enables dumping of PE headers, sections, and resources without requiring native Windows tools, making it ideal for Linux environments like Kali. The tool supports various output formats including binary, C-style, hex, JSON, and YAML, facilitating integration into analysis pipelines.

Use cases include malware reverse engineering, where analysts need to inspect PE structures, extract embedded resources like icons or manifests, or convert virtual addresses to file offsets. It also offers a web upload feature to generate interactive HTML reports with previews, useful for sharing findings.

The package is lightweight at 2.41 MB and depends on Ruby libraries like ruby-awesome-print and ruby-zhexdump. An interactive IRB console mode allows loading a PE file for dynamic exploration.

The tool parses Win32 PE file structures using pure Ruby, accessing headers, sections, data directories, and resources via offsets, RVAs, or names. It supports extraction by identifiers like datadir:EXPORT, resource:ICON/#1, or section:.text. Output is formatted in user-specified styles, with --force enabling aggressive parsing that may raise exceptions. The --va2file option performs RVA to raw file offset conversion based on PE section alignments.