$ show hfiref0x/WDExtract
WDExtract is a command-line utility for extracting and analyzing Windows Defender/Virus Definition files. It processes VDM (Virus Definition Module) containers and MRT.exe (Malicious Removal Tool) files to extract embedded data, including PE executables, DLLs, and security signatures. The tool can also merge base VDM files with their delta updates and extract raw RMDX containers without further processing. Built with C++ and Windows API, it uses zlib for decompression and implements custom logic for parsing PE files, applying VCDIFF delta patches, and extracting resources from PE files. The application is actively maintained with recent commits and uses GitHub Actions for Windows-based builds.
The LLM identified 3 files worth highlighting for reuse:
Implements generic PE image extraction from memory buffers. Scans for PE headers (MZ signature) and validates images before extraction. Handles both standard PE files and a special XML-based format (NIS) used by Windows Defender's Network Inspection System. Extracts PE images to files with names derived from export tables or version resources. Demonstrates deep understanding of PE file format and robust error handling. Could be reused in any malware analysis or forensic tool needing to extract embedded executables from memory or disk images.
Standalone implementation of the VCDIFF (RFC 3284) delta decoding algorithm. Takes base and delta buffers, applies the delta to reconstruct the original file, and includes optional checksum verification. Well-commented with detailed logging showing the decoding process. This component could be extracted and used in any application requiring binary delta application, such as software update systems, version control tools, or backup solutions. Shows strong algorithmic implementation skills.
Provides reusable Windows PE resource extraction and memory mapping utilities. Includes GetContainerFromResource() for extracting resources from PE files and MapContainerFile() for creating memory-mapped file views. These functions handle common Windows systems programming tasks with proper error handling and resource cleanup. The resource extraction function correctly navigates PE headers to find and load specific resource types, while the memory mapping function safely creates file views. Both demonstrate solid Windows API usage patterns.