pefile用于解析PE文件格式,github提供下载使用,并给出了使用范例。

https://github.com/erocarrera/pefile

import pefile

pe = pefile.PE('notepad.exe')

AddressOfEntryPoint = hex(pe.OPTIONAL_HEADER.AddressOfEntryPoint)
ImageBase = hex(pe.OPTIONAL_HEADER.ImageBase)
NumberOfSections = hex(pe.FILE_HEADER.NumberOfSections)
print ('AddressOfEntryPoint: ', AddressOfEntryPoint)
print ('ImageBase: ', ImageBase)
print ('NumberOfSections: ', NumberOfSections)

# print section
print ('\nSection info:')
for section in pe.sections:
  print (section.Name, hex(section.VirtualAddress),
    hex(section.Misc_VirtualSize), hex(section.PointerToRawData), hex(section.SizeOfRawData) )
    
# print import directory
print ('\nImport directory info:')
for entry in pe.DIRECTORY_ENTRY_IMPORT:
  print ( entry.dll )
  for imp in entry.imports:
    print ( '\t', hex(imp.address), imp.name )

# print export directory
print ('\nExport directory info:')
for exp in pe.DIRECTORY_ENTRY_EXPORT.symbols:
  print ( hex(pe.OPTIONAL_HEADER.ImageBase + exp.address), exp.name, exp.ordinal )


Logo

开放原子开发者工作坊旨在鼓励更多人参与开源活动,与志同道合的开发者们相互交流开发经验、分享开发心得、获取前沿技术趋势。工作坊有多种形式的开发者活动,如meetup、训练营等,主打技术交流,干货满满,真诚地邀请各位开发者共同参与!

更多推荐