使用pefile解析PE文件格式

最新推荐文章于 2024-08-13 08:21:50 发布

小黑话不多

最新推荐文章于 2024-08-13 08:21:50 发布

阅读量3.4k

点赞数

分类专栏： Python

本文链接：https://blog.csdn.net/hurricane_0x01/article/details/51840705

版权

Python 专栏收录该内容

6 篇文章 0 订阅

订阅专栏

pefile用于解析PE文件格式，github提供下载使用，并给出了使用范例。

https://github.com/erocarrera/pefile

import pefile

pe = pefile.PE('notepad.exe')

AddressOfEntryPoint = hex(pe.OPTIONAL_HEADER.AddressOfEntryPoint)
ImageBase = hex(pe.OPTIONAL_HEADER.ImageBase)
NumberOfSections = hex(pe.FILE_HEADER.NumberOfSections)
print ('AddressOfEntryPoint: ', AddressOfEntryPoint)
print ('ImageBase: ', ImageBase)
print ('NumberOfSections: ', NumberOfSections)

# print section
print ('\nSection info:')
for section in pe.sections:
  print (section.Name, hex(section.VirtualAddress),
    hex(section.Misc_VirtualSize), hex(section.PointerToRawData), hex(section.SizeOfRawData) )
    
# print import directory
print ('\nImport directory info:')
for entry in pe.DIRECTORY_ENTRY_IMPORT:
  print ( entry.dll )
  for imp in entry.imports:
    print ( '\t', hex(imp.address), imp.name )

# print export directory
print ('\nExport directory info:')
for exp in pe.DIRECTORY_ENTRY_EXPORT.symbols:
  print ( hex(pe.OPTIONAL_HEADER.ImageBase + exp.address), exp.name, exp.ordinal )