使用pefile解析PE文件格式
pefile用于解析PE文件格式,github提供下载使用,并给出了使用范例。https://github.com/erocarrera/pefileimport pefilepe = pefile.PE('notepad.exe')AddressOfEntryPoint = hex(pe.OPTIONAL_HEADER.AddressOfEntryPoint)ImageBa
·
pefile用于解析PE文件格式,github提供下载使用,并给出了使用范例。
https://github.com/erocarrera/pefile
import pefile
pe = pefile.PE('notepad.exe')
AddressOfEntryPoint = hex(pe.OPTIONAL_HEADER.AddressOfEntryPoint)
ImageBase = hex(pe.OPTIONAL_HEADER.ImageBase)
NumberOfSections = hex(pe.FILE_HEADER.NumberOfSections)
print ('AddressOfEntryPoint: ', AddressOfEntryPoint)
print ('ImageBase: ', ImageBase)
print ('NumberOfSections: ', NumberOfSections)
# print section
print ('\nSection info:')
for section in pe.sections:
print (section.Name, hex(section.VirtualAddress),
hex(section.Misc_VirtualSize), hex(section.PointerToRawData), hex(section.SizeOfRawData) )
# print import directory
print ('\nImport directory info:')
for entry in pe.DIRECTORY_ENTRY_IMPORT:
print ( entry.dll )
for imp in entry.imports:
print ( '\t', hex(imp.address), imp.name )
# print export directory
print ('\nExport directory info:')
for exp in pe.DIRECTORY_ENTRY_EXPORT.symbols:
print ( hex(pe.OPTIONAL_HEADER.ImageBase + exp.address), exp.name, exp.ordinal )
开放原子开发者工作坊旨在鼓励更多人参与开源活动,与志同道合的开发者们相互交流开发经验、分享开发心得、获取前沿技术趋势。工作坊有多种形式的开发者活动,如meetup、训练营等,主打技术交流,干货满满,真诚地邀请各位开发者共同参与!
更多推荐
已为社区贡献1条内容
所有评论(0)