官术网_书友最值得收藏!

How to do it...

In the following steps, we will parse the PE header of a file, and then print out notable portions of it:

  1. Import the PE file and use it to parse the PE header of your desired file:
import pefile

desired_file = "python-3.7.2-amd64.exe"
pe = pefile.PE(desired_file)
  1. List the imports of the PE file:
for entry in pe.DIRECTORY_ENTRY_IMPORT:
print(entry.dll)
for imp in entry.imports:
print("\t", hex(imp.address), imp.name)

A small portion of the output is shown here:

  1. List the sections of the PE file:
for section in pe.sections:
print(
section.Name,
hex(section.VirtualAddress),
hex(section.Misc_VirtualSize),
section.SizeOfRawData,
)

The output of the previous code is as follows:

  1. Print a full dump of the parsed information:
print(pe.dump_info())

A small portion of the output is displayed here:

主站蜘蛛池模板: 张家口市| 安龙县| 瑞昌市| 密云县| 华安县| 图片| 十堰市| 宁南县| 邛崃市| 日喀则市| 建始县| 宽甸| 西盟| 东港市| 田阳县| 黎城县| 乐业县| 商南县| 大邑县| 富顺县| 永新县| 阿坝县| 通辽市| 台南市| 巩义市| 栾川县| 依安县| 聊城市| 板桥市| 岳阳市| 太仆寺旗| 晋江市| 高陵县| 修武县| 马龙县| 平谷区| 深水埗区| 玛曲县| 松桃| 扎兰屯市| 额尔古纳市|