extract-shellcode

Extract .text shellcode from Windows PE files with linker map precision.

Overview · Requirements · Install · Usage · Map files · Development · Safety

Overview

extract-shellcode is a small Rust toolkit for turning a Windows PE executable into a raw shellcode blob, then optionally testing that blob in memory on Windows.

Binary	Purpose
extract_shellcode	Parses a PE file, finds the first section named .text, reads the shellcode length from a linker .map file, and writes the trimmed bytes to disk.
test_shellcode	Loads a shellcode blob, prints basic diagnostics, allocates executable memory with VirtualAlloc, and calls into the buffer.

The extractor uses goblin for PE parsing and clap for the command-line interface.

Requirements

• Rust toolchain with edition 2024 support.
• A Windows PE executable and its matching linker map file.
• Windows if you plan to run test_shellcode; extraction can parse files on other platforms.

Install

Install the published crate:

cargo install extract-shellcode

Or build from source:

git clone https://github.com/11philip22/extract-shellcode.git
cd extract-shellcode
cargo build --release

Usage

Extract shellcode from a PE and linker map:

extract_shellcode --exe path\to\program.exe --map path\to\program.map --out shellcode.bin

The same command through Cargo while developing locally:

cargo run --bin extract_shellcode -- --exe path\to\program.exe --map path\to\program.map --out shellcode.bin

Inspect and execute the extracted blob on Windows:

test_shellcode --input shellcode.bin

Or run it from source:

cargo run --bin test_shellcode -- --input shellcode.bin

Short flags are also available:

extract_shellcode -e program.exe -m program.map -o shellcode.bin
test_shellcode -i shellcode.bin

Map files

The extractor looks for the first map line that contains both .text and CODE, then parses the second whitespace-delimited column as a hexadecimal length ending in H:

0001:00000000 00000XXXH .text CODE

That length controls how many bytes are kept from the PE section's raw .text data. If the map length is larger than the section data, extraction fails instead of writing a truncated or malformed blob.

Development

Useful local checks:

cargo fmt
cargo clippy --all-targets --all-features
cargo test
cargo build --release

Safety

Caution

test_shellcode allocates read-write-execute memory and transfers control to the bytes you provide. Run only known-safe shellcode in an isolated Windows environment.

Common failure cases:

• No .text section found in PE file: the extractor requires a section named exactly .text.
• Could not find .text CODE entry in map file: the map file does not include the expected .text CODE line.
• Shellcode execution only supported on Windows: test_shellcode was run on a non-Windows platform.