Besides some small fixes the
new release of pefile is able to report suspicious or malformed entries encountered while parsing. Any time that a non-critical (something that wouldn't prevent the file from running) problem is found it's added to a list of warnings that can be retrieved
get_warnings() or shown
show_warnings()Example warning messages:
- Suspicious NumberOfRvaAndSizes in the Optional Header. Normal values are never larger than 0x10, the value is: 0xdfffddde
|
- Error parsing the import table. Invalid data at RVA: 0x400000
- Error parsing the Import directory. Invalid Import data at RVA: 0x60
- Error parsing export directory at RVA: 0x6c6c642e
|
