pefile用于解析PE文件格式,github提供下载使用,并给出了使用范例。

https://github.com/erocarrera/pefile

import pefile

pe = pefile.PE('notepad.exe')

AddressOfEntryPoint = hex(pe.OPTIONAL_HEADER.AddressOfEntryPoint)
ImageBase = hex(pe.OPTIONAL_HEADER.ImageBase)
NumberOfSections = hex(pe.FILE_HEADER.NumberOfSections)
print ('AddressOfEntryPoint: ', AddressOfEntryPoint)
print ('ImageBase: ', ImageBase)
print ('NumberOfSections: ', NumberOfSections)

# print section
print ('\nSection info:')
for section in pe.sections:
  print (section.Name, hex(section.VirtualAddress),
    hex(section.Misc_VirtualSize), hex(section.PointerToRawData), hex(section.SizeOfRawData) )
    
# print import directory
print ('\nImport directory info:')
for entry in pe.DIRECTORY_ENTRY_IMPORT:
  print ( entry.dll )
  for imp in entry.imports:
    print ( '\t', hex(imp.address), imp.name )

# print export directory
print ('\nExport directory info:')
for exp in pe.DIRECTORY_ENTRY_EXPORT.symbols:
  print ( hex(pe.OPTIONAL_HEADER.ImageBase + exp.address), exp.name, exp.ordinal )


Logo

瓜分20万奖金 获得内推名额 丰厚实物奖励 易参与易上手

更多推荐