官术网_书友最值得收藏!

How to do it...

In the following steps, we will parse the PE header of a file, and then print out notable portions of it:

  1. Import the PE file and use it to parse the PE header of your desired file:
import pefile

desired_file = "python-3.7.2-amd64.exe"
pe = pefile.PE(desired_file)
  1. List the imports of the PE file:
for entry in pe.DIRECTORY_ENTRY_IMPORT:
print(entry.dll)
for imp in entry.imports:
print("\t", hex(imp.address), imp.name)

A small portion of the output is shown here:

  1. List the sections of the PE file:
for section in pe.sections:
print(
section.Name,
hex(section.VirtualAddress),
hex(section.Misc_VirtualSize),
section.SizeOfRawData,
)

The output of the previous code is as follows:

  1. Print a full dump of the parsed information:
print(pe.dump_info())

A small portion of the output is displayed here:

主站蜘蛛池模板: 惠来县| 汉寿县| 永年县| 南郑县| 固安县| 建水县| 吴旗县| 双牌县| 社旗县| 恩施市| 漳浦县| 太湖县| 奉化市| 勃利县| 崇礼县| 乃东县| 平舆县| 广平县| 莱芜市| 隆化县| 万荣县| 绥江县| 大洼县| 米易县| 行唐县| 蛟河市| 沾化县| 昭苏县| 孟津县| 和静县| 盘山县| 无为县| 合江县| 水富县| 汕头市| 伊川县| 许昌县| 红原县| 广河县| 瓮安县| 舞阳县|