simple PE parser
Python
Switch branches/tags
Nothing to show
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Permalink
Failed to load latest commit information.
.gitignore
README.md
__init__.py
defines.py
pe.py

README.md

pe

simple PE parser

Features

  • IMAGE_DIRECTORY_ENTRY_IMPORT
  • IMAGE_DIRECTORY_ENTRY_EXPORT
  • mapped data extracted to memory
  • support both 32bit and 64bit binary

sample code

from pe import PE

# list export functions
pe = PE('kernel32.dll')
print "ImageBaseAddr: 0x{0:08x}".format(pe.imagebase)
for api, addr in pe.exports.items():
    print "{0} @ 0x{1:08x}".format(api, addr)

# list import functions
pe = PE('test.exe')
print "ImageBaseAddr: 0x{0:08x}".format(pe.imagebase)
for dllname in pe.imports:
    for api, addr in pe.imports[dllname].items():
        print "{0} ({1}) @ 0x{2:08x} (IAT)".format(api, dllname, addr)