README.md

pecarve

stoQ plugin that carves PE executables from payloads.

Plugin Classes

• Worker

Configuration

All options below may be set by:

• plugin configuration file
• stoq command
• Stoq class

Options

• pe_headers [str]: Regex pattern to match for PE headers (i.e., MZ or ZM)