PeBundle 3.20 (Unpacking & Inline Patching)

I haven't seen many tutorials on how to unpack PE Bundle and I have seen even less on how to create an inline patch for it so I hope this may un-fog any problems anyone has with it. PE Bundle may look difficult to begin with but it is very much the same as PE Compact and as you will shortly see it really is a piece of cake.

What is PE Bundle and why is it different yet similar to PE Compact? The main difference with PE Bundle to PE Compact and other PE packer/protectors is that it allows any .dll files that need to be distributed with the main executable to be included and compressed in to one complete file for distribution. There are numerous logical advantages to this both for the author of the software and the end user. There are two methods that can be used to extract the .dll files by PE Bundle (set during the packing process); the first is to extract the files to disk from where they can then be run or the second method is to bind them with the executable and extract/run them directly in memory. Neither method will affect us in extracting or unpacking the PE Bundle files manually.

There seems to be a little miss-information regarding the unpacking of PE Bundle when it comes to extracting and running .dll files in memory. PE Bundle does a very nice job of packing and including all the .dll files with the executable in memory by binding them to the main executable through a loader. This is good for you (the unpacker) because it means less work as we will not need to extract every single .dll file back to disk; we will unpack all the files complete with the loader in to one complete repackaged executable.

Okay, let us get to work, if you have unpacked PE Compact before then nothing here will surprise you!