title: Which bytes should i pass to Capstone to disassemble the executable code of a PE file
body: <p>Im trying to disassemble a PE executable with python using pefile and capstone to later obtain the CFG from that code. My idea is to take the portion of PE file that holds the executable code and pass all those bytes to capstone. What i don't know is exactly which portion should i pass to capstone so no more code than the necessary is disassembled and the RVAs can be resolved when constructing the CFG (i.e jo 0x10df9 and the address 0x10df9 is in the list of disassembled instructions). I've tried with</p>
  
  <pre><code>    md.disasm(pe.get_memory_mapped_image(), pe.OPTIONAL_HEADER.AddressOfEntryPoint)
  </code></pre>
  
  <p>But i'm affraid it will disassemble from entry point to the end of the PE and i just want to disassemble the executable code. I've been reading about the PE format and is more likely that the code will always be at the section .text. I was thinking also about take that section with:</p>
  
  <pre><code>    code_section = pe.get_section_by_rva(pe.OPTIONAL_HEADER.AddressOfEntryPoint)
  </code></pre>
  
  <p>and then pass to capstone the data of that section starting at the bytes in the EntryPoint which i think can delimit the data from the starting point to the end of that section.</p>
  
  <pre><code>    md.disasm(code_section.get_data(pe.OPTIONAL_HEADER.AddressOfEntryPoint))
  </code></pre>
  
  <p>But at the end of the section might be code that should not be disassembled (i think, not sure). So what i'm asking is which bytes should i pass to Capstone to disassemble the executable code of a PE file.</p>