前言
过程
dll/exe
sys
代码判断
# 获得pe文件类型 dll/exe/sys等
def get_file_type(binary) :
file_type = -1
if binary.header.has_characteristic(lief.PE.HEADER_CHARACTERISTICS.DLL) == True:
# dll
print("dll")
else:
# sys
if binary.get_import("ntoskrnl.exe") \
and binary.optional_header.subsystem == lief.PE.SUBSYSTEM.NATIVE:
print("sys")
# exe
else:
print("exe")