官术网_书友最值得收藏!

How to do it...

In the following steps, we will parse the PE header of a file, and then print out notable portions of it:

  1. Import the PE file and use it to parse the PE header of your desired file:
import pefile

desired_file = "python-3.7.2-amd64.exe"
pe = pefile.PE(desired_file)
  1. List the imports of the PE file:
for entry in pe.DIRECTORY_ENTRY_IMPORT:
print(entry.dll)
for imp in entry.imports:
print("\t", hex(imp.address), imp.name)

A small portion of the output is shown here:

  1. List the sections of the PE file:
for section in pe.sections:
print(
section.Name,
hex(section.VirtualAddress),
hex(section.Misc_VirtualSize),
section.SizeOfRawData,
)

The output of the previous code is as follows:

  1. Print a full dump of the parsed information:
print(pe.dump_info())

A small portion of the output is displayed here:

主站蜘蛛池模板: 沙河市| 平定县| 松溪县| 方山县| 桐柏县| 收藏| 兴仁县| 云林县| 富锦市| 利辛县| 沧州市| 贡山| 西畴县| 普兰县| 青州市| 司法| 始兴县| 措美县| 阜阳市| 盐亭县| 昌江| 东宁县| 盐池县| 东明县| 宜兰县| 潞西市| 灌南县| 安徽省| 柳江县| 金湖县| 常熟市| 湖南省| 镇康县| 旬邑县| 丰城市| 甘德县| 禹城市| 衡水市| 塘沽区| 伊宁县| 通州市|