官术网_书友最值得收藏!

How to do it...

In the following steps, we will parse the PE header of a file, and then print out notable portions of it:

  1. Import the PE file and use it to parse the PE header of your desired file:
import pefile

desired_file = "python-3.7.2-amd64.exe"
pe = pefile.PE(desired_file)
  1. List the imports of the PE file:
for entry in pe.DIRECTORY_ENTRY_IMPORT:
print(entry.dll)
for imp in entry.imports:
print("\t", hex(imp.address), imp.name)

A small portion of the output is shown here:

  1. List the sections of the PE file:
for section in pe.sections:
print(
section.Name,
hex(section.VirtualAddress),
hex(section.Misc_VirtualSize),
section.SizeOfRawData,
)

The output of the previous code is as follows:

  1. Print a full dump of the parsed information:
print(pe.dump_info())

A small portion of the output is displayed here:

主站蜘蛛池模板: 娄底市| 米林县| 湟源县| 宝山区| 章丘市| 玉林市| 达孜县| 河西区| 泽州县| 且末县| 奇台县| 尼勒克县| 梁山县| 淄博市| 阳高县| 五指山市| 大姚县| 麟游县| 云霄县| 巩义市| 龙泉市| 隆子县| 观塘区| 论坛| 富宁县| 焉耆| 米林县| 靖边县| 上林县| 荔波县| 呼伦贝尔市| 轮台县| 南投县| 五大连池市| 镇安县| 宣武区| 萝北县| 涞水县| 大关县| 忻城县| 泗洪县|