官术网_书友最值得收藏!

How to do it...

In the following steps, we will parse the PE header of a file, and then print out notable portions of it:

  1. Import the PE file and use it to parse the PE header of your desired file:
import pefile

desired_file = "python-3.7.2-amd64.exe"
pe = pefile.PE(desired_file)
  1. List the imports of the PE file:
for entry in pe.DIRECTORY_ENTRY_IMPORT:
print(entry.dll)
for imp in entry.imports:
print("\t", hex(imp.address), imp.name)

A small portion of the output is shown here:

  1. List the sections of the PE file:
for section in pe.sections:
print(
section.Name,
hex(section.VirtualAddress),
hex(section.Misc_VirtualSize),
section.SizeOfRawData,
)

The output of the previous code is as follows:

  1. Print a full dump of the parsed information:
print(pe.dump_info())

A small portion of the output is displayed here:

主站蜘蛛池模板: 库伦旗| 阳高县| 桐庐县| 双桥区| 邵武市| 太康县| 南阳市| 方山县| 永昌县| 马鞍山市| 拜城县| 嘉善县| 冕宁县| 岱山县| 叶城县| 广灵县| 中阳县| 辽阳市| 华阴市| 房山区| 定结县| 诸城市| 北票市| 凤翔县| 岐山县| 资溪县| 龙口市| 通州市| 望谟县| 邛崃市| 苏州市| 普洱| 大关县| 永丰县| 丰原市| 宁德市| 望奎县| 仪陇县| 库尔勒市| 唐河县| 蕲春县|