Re: Hachoir-subfile

Non j'y avais pas pensé, je n’avais jamais utilisé hachoir même si j'en avais déjà entendu parler ici.

Voilà ce que ça donne :

hachoir-subfile E7793V3C.exe 
[+] Start search on 11256733 bytes (10.7 MB)
[+] File at 0 size=1716224 (1.6 MB): Microsoft Windows Portable Executable: Intel 80386, Windows GUI
[+] File at 1716576 size=194329 (189.8 KB): MS-DOS executable
[+] File at 1911072 size=270336 (264.0 KB): Microsoft Windows Portable Executable: Intel 80386, Windows CUI
[+] File at 2181536 size=5760 (5760 bytes): Microsoft Windows Portable Executable: Intel 80386, Native
[+] File at 2187296 size=1168 (1168 bytes): MS-DOS executable
[err!] Error getting description of /: Can't get field "subsystem" from /pe_opt_header
[+] File at 2195543 size=350208 (342.0 KB): Microsoft Windows Portable Executable
[+] File at 2365346 size=7522816 (7.2 MB): MS-DOS executable
[err!] Error getting description of /: Can't get field "subsystem" from /pe_opt_header
[+] File at 2545879 size=9216 (9216 bytes): Microsoft Windows Portable Executable
[+] File at 2601773 size=91648 (89.5 KB): Microsoft Windows Portable Executable: Intel 80386, Windows CUI
[+] File at 2693421 size=90112 (88.0 KB): Microsoft Windows DLL: Intel 80386, Windows GUI
[+] File at 2783533 size=30720 (30.0 KB): Microsoft Windows Portable Executable: Intel 80386, Native
[err!] Error getting description of /: Can't get field "subsystem" from /pe_opt_header
[+] File at 2821733 size=38912 (38.0 KB): Microsoft Windows Portable Executable
[+] File at 3130269: EFI Platform Initialization Firmware Volume
[+] File at 4506525: EFI Platform Initialization Firmware Volume
[+] File at 9993940 size=7784960 (7.4 MB): MS-DOS executable
[+] File at 9994066 size=7522816 (7.2 MB): MS-DOS executable
[+] File at 9995308 size=12390400 (11.8 MB): MS-DOS executable
[+] End of search -- offset=11256733 (10.7 MB)
Total time: 773 ms -- global rate: 13.9 MB/sec

Je ne retrouves malheureusement pas les positions sur lesquelles je suis tombé avec l'éditeur hexa.