The purpose of this script is to verify the presence of a PE file in an IDA DB, correctly calculate the size from the PE header, and write the file to disk
This script was written on Carbon Black time. Thank you for the time and support to write something I've been meaning to write for some time
Open file in IDA pro. Point cursor at the M (or 0x4D) in the IDA DB and run this script
Select File->Script File... and select idadump_mz.py
For testing I have provided binaries that contain an embedded binary inline as well as binary in the .rsrc section. Here are the results of both being dumped to disk
